Searches getting delayed at a particular time everyday

[ankitarath2011]

Searches starting to take more time to execute and then getting deferred at 9:10 am everyday. Number of searches are same throughout the day. No extra searches running around that time.

[ankitarath2011]

I have already checked scheduled searches around that time. One of the savedsearch taking more time around that time. But Had checked cron as well. Looks fine as nothing is scheduled around that time.it is running fine other time of the day wit similar number of events. 

[codebuilder]

Check for long running scheduled/saved searches that start around that time. Look for any that return heavy payloads or too many events (all-time searches, e.g.).

Check your cron schedule for non Splunk related activity that could impact the system resources, such as backups kicking in, etc.

[ankitarath2011]

I have already checked scheduled searches around that time. One of the savedsearch taking more time around that time. But Had checked cron as well. Looks fine as nothing is scheduled around that time.it is running fine other time of the day wit similar number of events. 

[isoutamo]

You should use MC (monitoring console) to check what was happening on that time. You could start with search - scheduled searches with that time frame.

r. Ismo