Splunk Enterprise Security

Please advise on a Strategy dealing with increasing number of skipped / saved searches in ES? Thank u


Please advise on a Strategy dealing with increasing number of skipped / saved / deferred searches in Enterprise Security? The numbers are increasing daily .Thank u

Labels (1)
Tags (1)
0 Karma


It depends on the reason for the skip.  In general, a search is skipped because there are no search "slots" available at the scheduled time .  There are several ways to alleviate the problem:

  1. Run fewer searches
  2. Ensure all scheduled searches (including alerts) have a schedule_window value other than 0 (I prefer "auto").
  3. Spread searches out across the clock so there's less contention for resources.
  4. A search will be skipped if it's still running at the next interval, so make them run faster or schedule them less often.
  5. Ban all real-time searches.
  6. Run scheduled searches less often.
  7. Increase the max_searches_perc setting in limits.conf.
  8. Increase the base_max_searches setting.
  9. Add CPUs to the SH.
  10. Make sure the indexers are not overloaded, making them slow to process searches.
  11. Make sure data is even distributed among indexers so searches run faster.
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...