Splunk Search

How do I investigate delayed searched reported in Health status under Splunkd

SamHTexas
Builder

I keep getting delayed searches marked in red "Health Status - Splunkd". How do I investigate and fix this issue?

Labels (1)
Tags (1)
0 Karma

tscroggins
Motivator

@SamHTexas 

The simplest method is the local monitoring console. Click Settings > Monitoring Console. In the app bar, click Search > Scheduler Activity: Instance. In the Historical Charts section of the dashboard, you can see various panels related to search scheduling.

If you find many deferred searches, you have three options:

1. Optimize scheduled searches.
2. Adjust limits. See https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf#Concurrency.
3. Add CPUs. (This is often Splunk's recommendation, but try optimization first.)

0 Karma

SamHTexas
Builder

Thank u. In the historical section.  I see "no results found" and 0 for total historical chart area ( at bottom left). No matter what I change in the time range or group by items, nothing happens. Please advise.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...