The first thing to do is determine *why* the searches are being skipped. Then you can take corrective measures and avoid having to worry about replays. The most common causes of skipped searches are 1) too many searches running at the same time; and 2) searches not completing before the next scheduled run-time. The Monitoring Console will list skip searches and the reason(s) for the skips. To correct the first issue, examine the schedules of each search and ensure they are evenly distributed around the clock (as much as is practical, at least). It's very common for the majority of searches to run at top of each hour. To avoid that, look for cron schedules that start with "0" or "*". To correct the second issue, examine the search to see why it is slow. It's possible the SPL could be made more efficient, or perhaps it's searching too much data or too large of a time window. If the search cannot be improved then change the schedule so it runs less often. Finally, consider running the searches on a continuous schedule. That prevents them from being skipped. See https://help.splunk.com/en/splunk-enterprise-security-7/tutorials-and-use-cases/7.3/correlation-search-tutorial/part-4-schedule-the-correlation-search
... View more
