Splunk Enterprise

Searches getting delayed at a particular time everyday

ankitarath2011
Explorer

Searches starting to take more time to execute and then getting deferred at 9:10 am everyday. Number of searches are same throughout the day. No extra searches running around that time.

Labels (2)
0 Karma

ankitarath2011
Explorer

I have already checked scheduled searches around that time. One of the savedsearch taking more time around that time. But Had checked cron as well. Looks fine as nothing is scheduled around that time.it is running fine other time of the day wit similar number of events. 

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Check for long running scheduled/saved searches that start around that time. Look for any that return heavy payloads or too many events (all-time searches, e.g.).

Check your cron schedule for non Splunk related activity that could impact the system resources, such as backups kicking in, etc.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

ankitarath2011
Explorer

I have already checked scheduled searches around that time. One of the savedsearch taking more time around that time. But Had checked cron as well. Looks fine as nothing is scheduled around that time.it is running fine other time of the day wit similar number of events. 

Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

You should use MC (monitoring console) to check what was happening on that time. You could start with search - scheduled searches with that time frame.

r. Ismo

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!