To reduce resource burden of scheduled searches (reports) and alerts off of the search heads, I have configured a default-mode.conf file to disable the pipeline:scheduler and created a separate job server. In Splunk v5, when I added a panel calling a saved search to a simple dashboard, it ran with no issues even though the pipeline:scheduler was disabled. Upgrading to Splunk v6, I now get “In handler ‘savedsearch’: Search scheduler has not started yet.” as an error in that panel.
Cloning to an inline search works. Also, converting the panel to run an inline search which calls the report using the ‘savedsearch’ command works.
Does running a saved search (report) in a dashboard panel on an ad-hoc basis (every time the dashboard is loaded) not work anymore in v6 with the scheduler disabled?
... View more
