What is difference between "deferred" and "continued" search

[ankitarath2011]

I can see below status for the scheduled savedsearches.

status="deferred"
status="continued"

What is the difference between the two and which one will get skipped later on(status="skipped")
Are there any "failed" status as well?

[richgalloway]

Both status values have the same cause, but different behaviors.  A deferred search will be skipped if it cannot run within the schedule window.  A continued search will run at the next opportunity.

[richgalloway]

A search is deferred if it cannot run because there are no search slots, but the schedule_window setting allows Splunk to wait for a slot to become available.  If no search slot opens up before the schedule window closes then the search is skipped.

A continued search is a continuous search (realtime_schedule=0) that could not be scheduled.  The scheduler will keep retrying the search and not skip it.

[ankitarath2011]

Hi @richgalloway  
Thank you for your response.
If a continued search could not be scheduled/started, then how is it continuous?

Also, deferred search could also not be scheduled, are both not same?

[PickleRick]

There are two types of scheduling modes for a saved search - real-time (not to be confused with real-time searches!) and continuous.

Oversimplifying (but just a bit):

- A real-time scheduled search will try to execute a search covering time from t0 till t1 at some point in time tA. It might not get executed at tA because the SH(C) is overloaded. In that case scheduler will try to execute it until tA+(schedule window). If it cannot run the search because the SH(C) is still overloaded, it will finally give up. Next scheduled run of the same search which might occur at some tB in the future will cover time from t2 to t3.

- A continuously scheduled search will try to run the search from t0 till t1 at tA. If it cannot find a free "search slot", it will retry the same search (still from t0 till t1) until it finally can.

Additional difference here is that for real-time scheduled search if the schedule window is sufficiently big, or if there were sufficiently many skipped occurrences of the search, you might have significant periods of your data not covered by run searches. The point of continuous-scheduled searches is to finally get all your data (hence the "continuous") covered by searches at the expense of "response time" (the more searches you have and the more "clogged" your search heads are, the bigger "lag" you will have because scheduler will search more and more for the opportunity to run queued searches over old data).

More information here (the scheduling mechanics works the same for reports and alerts - they are all just scheduled searches).

https://docs.splunk.com/Documentation/Splunk/latest/Report/Configurethepriorityofscheduledreports