Concurrent scheduled saved searches

[bckq]

I have about 50 saved scheduled searches that run every minute. And now, there is a situation that every minute those searches are calculating all in one time and my CPU has got a high load that time. Is it possible to rebalance those saved searches to run through all 60 seconds, not all in one time?

[znaesh]

Can enable skewing or schedule a bash script that spawns particular search requests every second.

[yannK · Accepted solution]

The scheduler is based on a cron implementation, so I assume that the minute is the smallest interval.

Here are some tracks :

• make an enhancement request.
• group some searches that are similar into a single alert with a field for the details of the type of alert.
• add more dedicated search-heads (if the indexers still have room for concurrent searches)

[EDIT] for details about the scheduler behavior http://docs.splunk.com/Documentation/Splunk/4.3.4/Knowledge/Schedulesearchpriority