Efficient scheduling of the correlation searches in Splunk ITSI to avoid skipping of concurrent running jobs.

[ManjunathNargun]

Hi,

How to efficiently schedule the correlation searches in Splunk ITSI to avoid skipping of concurrent running jobs.

We can see the below message in skipped searches.

Thanks!

[srauhala_splunk]

Hi @ManjunathNargun 

The key is to have the searches execute before their next schedule time. If you run a search every 5 min it should not take more then 5 min to complete. 

See https://docs.splunk.com/Documentation/Splunk/9.1.1/Search/Writebettersearches on how to write efficient searches. 

Other options are to reduce search frequency or add more search resources (search head and indexer CPU resources)

/Seb