Splunk Health Warning on Search Head

[Roy_9]

Hello,

We are using Splunk cloud and seeing the below error message on SH.

 Search Scheduler Search Lag

• Root Cause(s):
  • The number of extremely lagged searches (4) over the last hour exceeded the red threshold (1) on this Splunk instance

Can someone please help me in fixing this issue?

Thanks

[richgalloway]

Use the Cloud Monitoring Console app to see which searches are lagged.  Go to Search->Scheduler Activity and scroll down to the Execution Latency panel.  Group the results by Report Name to find the offending searches.

Try rescheduling the searches to a time when fewer other searches are running.