Splunk Dev

Saved Search not returning all events

varun85negi
Engager

Hi All,

We have a Splunk saved search in which we are querying same index but multiple sourcetypes like below:

(Index=A sourcetype=A1) OR (index=A (sourcetype=A2 OR sourcetype=A3 OR sourcetype=A4))

Issue is sometimes the events from 2nd part is not returned (Sourcetype A2, A3 and A4) but events from 1st part is correctly returned.

Below are some messages from internal logs:

search_type=" scheduled ", user="X", app="X", savedsearch_name="X", priority=default, status=continued, reason="The maximum number of concurrent running jobs for this historical scheduled search on this cluster has been reached", concurrency_category="historical_scheduled", concurrency_context="saved-search_cluster-wide", concurrency_limit=1, scheduled_time=1521180300, window_time=0

search_type="scheduled", user="X", app="X", savedsearch_name="X", priority=default, status=continued, reason="The maximum number of concurrent historical scheduled searches on this cluster has been reached", concurrency_category="historical_scheduled", concurrency_context="cluster-wide", concurrency_limit=69, scheduled_time=1521180300, window_time=0

search_type="scheduled", user="X", app="X", savedsearch_name="X", priority=default, status=continued, reason="The maximum number of concurrent historical scheduled searches on this cluster has been reached", concurrency_category="historical_scheduled", concurrency_context="cluster-wide", concurrency_limit=69, scheduled_time=1521180300, window_time=0

Tags (1)
0 Karma

Azeemering
Builder

How often do you run this saved search?
If a saved search is scheduled to run every minute, but it takes five minutes to run, then it will skip the next four times that it tries to run....

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...