What is scheduler log event status=Continued ?

[nishantkumar007]

We have a log of saved searches working simultaneously in our search head. Around 70% of which are resulting status= Continued.

What does it mean, does it affect the alerts that we have created, does it mean they were not able to finish properly and hence the alerts are not getting triggered properly.
thanks

[sbhale]

status=Continued means that splunk was unable to run your search as scheduled, But it will catch up and run it for the time period it was supposed to run.
For example your search looking at data from 00:15 - 00:30 was supposed to run at 00:30. But it got the above status.
What splunk will do is run the search for the timeframe 00:15-00:30 at say 00:40. So the results will(mostly) be the same. I say mostly because you can have data show up later and the results may differ because of that.
Splunk will choose to continue searches that are meant to fill summary data etc which can be more flexible than say alerts.

[somesoni2]

See a similar post:
https://answers.splunk.com/answers/140168/what-is-scheduler-status-continued.html