If you schedule the first search, you could schedule a second search which looks for result_count=0 in the internal log: index=_internal startminutesago=5 sourcetype=scheduler savedsearch_name="name_of_first_scheduled_search" status=success result_count=0 | append [ search "second search query" ] ... View more

I am seeing the same issue. It will just randomly get removed from the schedule. Debug refresh will cause it to get added to the schedule again, but it will not start running again until I disable and re-enable. I have checked the _internal and opened up the splunkd.log locally. No errors. I have performed the basic troubleshooting listed by grijhwani and no luck. ... View more