How to change the cron schedule of around 500 saved searches at once in Splunk Cloud so spread across the clock?

[bhagyashriyan]

Hi, I have many concurrent saved searches running due to which search delayed health indicator is always red. How to change the cron schedule of around 500 saved searches together at once in splunk cloud so spread across the clock?

TIA

[richgalloway]

You can't.  Changing 500 searches together would have them all run at the same different time.  Splunk does not have an Easy Button that will reschedule your searches for you.

Each search has to be re-scheduled individually.   You don't have to change them all, however.  Focus first on the searches that run 0, 15, 30, and 45 minutes after the hour as they tend to be the busiest times.

While you're at it, reconsider how often each search runs.  Reducing the number of runs will help cut down on delayed and skipped searches.