Splunk Searches Skipped on the Cluster master console error messages
The percentage of non high priority searches skipped (44%) over the last 24 hours is very high and exceeded the red thresholds (20%) on this Splunk instance. Total Searches that were part of this percentage=1608..... Total skipped Searches=720...
@isoutamo After identifying those searches, what is the process to remove the warning message, since we are seeing the similar kind of issue on our SH where our SH health is red.
After you have identified those, you also see what was the reason for that. Then just fix the reason one by one. That could be e.g. too many search at same time => reschedule, no permission to indexed/run => fix permission/change ownership etc.
You should check what those are from MC (Settings - Monitoring Console - Searches - Schedule searches). There you can see when, where and what those are. r. Ismo
