Splunk Search

How to change the cron schedule of around 500 saved searches at once in Splunk Cloud so spread across the clock?


Hi, I have many concurrent saved searches running due to which search delayed health indicator is always red. How to change the cron schedule of around 500 saved searches together at once in splunk cloud so spread across the clock?


Labels (1)
Tags (1)
0 Karma


You can't.  Changing 500 searches together would have them all run at the same different time.  Splunk does not have an Easy Button that will reschedule your searches for you.

Each search has to be re-scheduled individually.   You don't have to change them all, however.  Focus first on the searches that run 0, 15, 30, and 45 minutes after the hour as they tend to be the busiest times.

While you're at it, reconsider how often each search runs.  Reducing the number of runs will help cut down on delayed and skipped searches.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...