Splunk Enterprise

Searches getting delayed at a particular time everyday

ankitarath2011
Path Finder

Searches starting to take more time to execute and then getting deferred at 9:10 am everyday. Number of searches are same throughout the day. No extra searches running around that time.

Labels (2)
0 Karma

ankitarath2011
Path Finder

I have already checked scheduled searches around that time. One of the savedsearch taking more time around that time. But Had checked cron as well. Looks fine as nothing is scheduled around that time.it is running fine other time of the day wit similar number of events. 

0 Karma

codebuilder
SplunkTrust
SplunkTrust

Check for long running scheduled/saved searches that start around that time. Look for any that return heavy payloads or too many events (all-time searches, e.g.).

Check your cron schedule for non Splunk related activity that could impact the system resources, such as backups kicking in, etc.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

ankitarath2011
Path Finder

I have already checked scheduled searches around that time. One of the savedsearch taking more time around that time. But Had checked cron as well. Looks fine as nothing is scheduled around that time.it is running fine other time of the day wit similar number of events. 

Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

You should use MC (monitoring console) to check what was happening on that time. You could start with search - scheduled searches with that time frame.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...