Saved Search not returning all events

[varun85negi]

Hi All,

We have a Splunk saved search in which we are querying same index but multiple sourcetypes like below:

(Index=A sourcetype=A1) OR (index=A (sourcetype=A2 OR sourcetype=A3 OR sourcetype=A4))

Issue is sometimes the events from 2nd part is not returned (Sourcetype A2, A3 and A4) but events from 1st part is correctly returned.

Below are some messages from internal logs:

search_type=" scheduled ", user="X", app="X", savedsearch_name="X", priority=default, status=continued, reason="The maximum number of concurrent running jobs for this historical scheduled search on this cluster has been reached", concurrency_category="historical_scheduled", concurrency_context="saved-search_cluster-wide", concurrency_limit=1, scheduled_time=1521180300, window_time=0

search_type="scheduled", user="X", app="X", savedsearch_name="X", priority=default, status=continued, reason="The maximum number of concurrent historical scheduled searches on this cluster has been reached", concurrency_category="historical_scheduled", concurrency_context="cluster-wide", concurrency_limit=69, scheduled_time=1521180300, window_time=0

search_type="scheduled", user="X", app="X", savedsearch_name="X", priority=default, status=continued, reason="The maximum number of concurrent historical scheduled searches on this cluster has been reached", concurrency_category="historical_scheduled", concurrency_context="cluster-wide", concurrency_limit=69, scheduled_time=1521180300, window_time=0

[Azeemering]

How often do you run this saved search?
If a saved search is scheduled to run every minute, but it takes five minutes to run, then it will skip the next four times that it tries to run....