I have a few scheduled searches that become 'unscheduled' randomly. I don't notice this until I miss a service outage that I am trying to alert on. When I go to the saved search, the 'schedule this search' box is unchecked. When I recheck the box, all my original settings are there. What is happening and how do I stop this from changing?
Sorry - Answered my own question.... Output from the scheduler.log file shows : WARN SavedSplunker - Failed to set user context for saved search with id (blah) Disabling its schedule.
Because my user id was the owner and the password was recently changed. I think I will keep the critical searches not tied to a particular user in the future....