Hello,
We have several alerts which occasionally go in status waiting (correponding jobs) and stay like that. Then the next executions of these alerts are not triggered of course, so we get quite some skipped jobs.
The jobs overview states the jobs are in status "Parsing", however when I copy the corresponding search and execute in another search window it finishes quite fast.
Please see also the screenshot below. It seems to stuck in the following part (last entries in the search.log:
....
12-05-2022 06:40:02.915 INFO ChunkedExternProcessor [15318 searchOrchestrator]
- Running process: /vol1/opt/splunkdev2/splunk/bin/python3.7
/vol1/opt/splunkdev2/splunk/etc/apps/splunk_app_db_conn
I increased all possible limits and quotas I could come up with to lift any restrictions on the concurrency, but it did not help ...
How would I investigate it further?
