Splunk Search

How do I investigate delayed searched reported in Health status under Splunkd

SamHTexas
Builder

I keep getting delayed searches marked in red "Health Status - Splunkd". How do I investigate and fix this issue?

Labels (1)
Tags (1)
0 Karma

tscroggins
Influencer

@SamHTexas 

The simplest method is the local monitoring console. Click Settings > Monitoring Console. In the app bar, click Search > Scheduler Activity: Instance. In the Historical Charts section of the dashboard, you can see various panels related to search scheduling.

If you find many deferred searches, you have three options:

1. Optimize scheduled searches.
2. Adjust limits. See https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf#Concurrency.
3. Add CPUs. (This is often Splunk's recommendation, but try optimization first.)

0 Karma

SamHTexas
Builder

Thank u. In the historical section.  I see "no results found" and 0 for total historical chart area ( at bottom left). No matter what I change in the time range or group by items, nothing happens. Please advise.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...