Similarly, mismanaged or too-cluttered search schedules can impede organizations from getting real value out of Splunk. If you want to generate regular reports on the frequency of certain events (sales, visits to a certain page, 503 errors…the sky’s the limit when it comes to searchable events), then scheduled searches are a highly useful tool. These searches run in the background at a specified time and generate reports for key users.
But again, we often see those scheduled searches become too cluttered to provide the insights users want. We once helped a client who was convinced Splunk didn’t work because reports weren’t generating like they were supposed to. Well, when we learned that they had 100 thousand searches scheduled to run at the same time each night, we had our answer. The system was overloaded, and by spreading those searches out more effectively (along with quite a bit of other work to untangle the backlog), we were able to resolve the problem.
Mismanaging search times or time frames, or allowing users to schedule too many unnecessary searches, can be detrimental to Splunk’s ability to run searches and generate useful reports. Learn more about managing scheduled searches in this post.