Reporting

Why are my scheduled searches becoming unscheduled?

tbonet
Engager

I have a few scheduled searches that become 'unscheduled' randomly. I don't notice this until I miss a service outage that I am trying to alert on. When I go to the saved search, the 'schedule this search' box is unchecked. When I recheck the box, all my original settings are there. What is happening and how do I stop this from changing?

Tags (1)

tbonet
Engager

Sorry - Answered my own question.... Output from the scheduler.log file shows : WARN SavedSplunker - Failed to set user context for saved search with id (blah) Disabling its schedule.

Because my user id was the owner and the password was recently changed. I think I will keep the critical searches not tied to a particular user in the future....

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...