Splunk Health Warning on Search Head

Roy_9 · ‎10-15-2021

Hello,

We are using Splunk cloud and seeing the below error message on SH.

Search Scheduler Search Lag

Root Cause(s):
- The number of extremely lagged searches (4) over the last hour exceeded the red threshold (1) on this Splunk instance

Can someone please help me in fixing this issue?

Thanks

richgalloway · ‎10-15-2021

Use the Cloud Monitoring Console app to see which searches are lagged. Go to Search->Scheduler Activity and scroll down to the Execution Latency panel. Group the results by Report Name to find the offending searches.

Try rescheduling the searches to a time when fewer other searches are running.

---
If this reply helps you, Karma would be appreciated.

Splunk Health Warning on Search Head

Search Scheduler Search Lag

host

source

sourcetype

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Join the Conversation

Splunk Health Warning on Search Head

Search Scheduler Search Lag

host

source

sourcetype

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform