Please advise on a Strategy dealing with increasing number of skipped / saved searches in ES? Thank u

[SamHTexas]

Please advise on a Strategy dealing with increasing number of skipped / saved / deferred searches in Enterprise Security? The numbers are increasing daily .Thank u

[richgalloway]

It depends on the reason for the skip.  In general, a search is skipped because there are no search "slots" available at the scheduled time .  There are several ways to alleviate the problem:

1. Run fewer searches
2. Ensure all scheduled searches (including alerts) have a schedule_window value other than 0 (I prefer "auto").
3. Spread searches out across the clock so there's less contention for resources.
4. A search will be skipped if it's still running at the next interval, so make them run faster or schedule them less often.
5. Ban all real-time searches.
6. Run scheduled searches less often.
7. Increase the max_searches_perc setting in limits.conf.
8. Increase the base_max_searches setting.
9. Add CPUs to the SH.
10. Make sure the indexers are not overloaded, making them slow to process searches.
11. Make sure data is even distributed among indexers so searches run faster.