I'm not having too many issues with scheduled searches firing off. Unless there is a search head failure (common with 6.2.1's PDF scheduling bug) in which case things can get backed up. Also, captain changes can lead to multiple runs of some searches. ... View more

I have seen this happening when there is a high count of jobs in dispatch. If you are able to, run clean dispatch command to delete jobs older than X days or X hours (choose a number for the days or hours) http://answers.splunk.com/answers/139924/where-can-i-find-documentation-for-splunkd-clean-dispatch-command If you're in a pinch, delete everything in the dispatch directory but be aware that you may have some artifacts used by dashboards or saved by users that will be deleted. The search can always run again but that might not be ideal. ... View more

For these index time configs Splunk will look in etc/system/local on the indexer or forwarder. Indexer configs will take priority over the forwarder configs if the forwarder is Not a heavy forwarder. Placing in the app folder can work, but only if there are no conflicting configs in the system local folder. The best place is on the indexer, if there are no heavy forwarders involved. That way you can manage them from one place. Like linu1998 said, the system that holds the configs must be restarted, and it will only affect new events. ... View more

I think I answered my own question, use "eval newField=mvjoin(oldField,"") ... View more