I have many large jobs that take for ever to run sometimes 18-30 hours. Eventually error out. How to make a list. I have already tried below posted related to this subject but it does not list the large (bad boys) large jobs:
https://community.splunk.com/t5/Splunk-Search/What-causes-delayed-searches-alerts-in-Splunk-Enterpri...
&
Searches are delayed when there are no resources available at run-time and they have a non-zero Schedule Window. The delay lasts until the schedule window closes. If, at that time, the search still can't run then it becomes "skipped".
To resolve it, re-schedule the searches so fewer are scheduled at the same time. Pay particular attention to the :00, :15, :30, and :45 minutes of each hour. See https://github.com/dpaper-splunk/public/blob/master/dashboards/extended_search_reporting.xml for a helpful dashboard.
Just copy paste it to your node where you have those delayed searches as a dashboard.
Another option is use MC's Search -> Scheduler and look there what those searches are.
Anyhow you should look that time by time or create alert to inform you if there are lot of skipped or delayed searches.
