It depends on the reason for the skip. In general, a search is skipped because there are no search "slots" available at the scheduled time . There are several ways to alleviate the problem:
- Run fewer searches
- Ensure all scheduled searches (including alerts) have a schedule_window value other than 0 (I prefer "auto").
- Spread searches out across the clock so there's less contention for resources.
- A search will be skipped if it's still running at the next interval, so make them run faster or schedule them less often.
- Ban all real-time searches.
- Run scheduled searches less often.
- Increase the max_searches_perc setting in limits.conf.
- Increase the base_max_searches setting.
- Add CPUs to the SH.
- Make sure the indexers are not overloaded, making them slow to process searches.
- Make sure data is even distributed among indexers so searches run faster.
If this reply helps you, Karma would be appreciated.