Splunk Enterprise Security

Please advise on a Strategy dealing with increasing number of skipped / saved searches in ES? Thank u


Please advise on a Strategy dealing with increasing number of skipped / saved / deferred searches in Enterprise Security? The numbers are increasing daily .Thank u

Labels (1)
Tags (1)
0 Karma


It depends on the reason for the skip.  In general, a search is skipped because there are no search "slots" available at the scheduled time .  There are several ways to alleviate the problem:

  1. Run fewer searches
  2. Ensure all scheduled searches (including alerts) have a schedule_window value other than 0 (I prefer "auto").
  3. Spread searches out across the clock so there's less contention for resources.
  4. A search will be skipped if it's still running at the next interval, so make them run faster or schedule them less often.
  5. Ban all real-time searches.
  6. Run scheduled searches less often.
  7. Increase the max_searches_perc setting in limits.conf.
  8. Increase the base_max_searches setting.
  9. Add CPUs to the SH.
  10. Make sure the indexers are not overloaded, making them slow to process searches.
  11. Make sure data is even distributed among indexers so searches run faster.
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...