Splunk Search

Why is my search skipping?

kteng2024
Path Finder

Hi,

index=_internal source=*metrics.log group=searchscheduler | timechart partial=false span=10m sum(dispatched) sum(skipped) 

The above is the search i am using to find out number of skipped searches . But my question is , how to find the reasons why this search is skipping and how to stop them skipping like any configuration change?

1 Solution

woodcock
Esteemed Legend

Run the MC Health Checks to verify your compliance to HW Standards. By far the most common reason to skip a search is that the previous run has not completed so you will enter an infinite loop if you continue to (try to) run it again and again. There are 2 main causes. If the search is too aggressive, try scaling back the earliest/latest and also the frequency of running it. Do anything you can to optimize the search. The other cause is overwhelmed indexing tier. The Health Check will tell you if your HW is not according to minimum requirements. It really should be obvious when you need more Indexers and the symptoms like you are seeing is a very common one, as well as slow ad-hoc seraches that sometimes cannot complete and timeout.

View solution in original post

pradeepkumarg
Influencer

If you search for scheduler logs, you can find a field reason explaining why the search was skipped.

index=_internal sourcetype=scheduler status=skipped

Rsolution depends on what the reason is. could be capacity or some user reaching his allocated max disk space, etc..,

woodcock
Esteemed Legend

Run the MC Health Checks to verify your compliance to HW Standards. By far the most common reason to skip a search is that the previous run has not completed so you will enter an infinite loop if you continue to (try to) run it again and again. There are 2 main causes. If the search is too aggressive, try scaling back the earliest/latest and also the frequency of running it. Do anything you can to optimize the search. The other cause is overwhelmed indexing tier. The Health Check will tell you if your HW is not according to minimum requirements. It really should be obvious when you need more Indexers and the symptoms like you are seeing is a very common one, as well as slow ad-hoc seraches that sometimes cannot complete and timeout.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...