Scheduling Inspector identifies search coverage gaps for scheduled searches and provides an automated tool for correcting them. Coverage gaps are bad for Splunk because the time between each scheduled run of a search is greater than the time window in which your search runs. In this case, a search may miss the oldest data in the time window producing incomplete results.
Scheduling Inspector also identifies searches with excessive time windows. If the time between each run of scheduled search is less than the time window of your search, then mulitple runs may return overlapping results. Not only does the search use more system resources than necessary in this case, but it also may produce duplicate alerts or summary index events. With the workload based pricing model now being prevelent in Splunk, optimizing your scheduled searches in this way can help to keep your Splunk Cloud costs down.
- Reveals misconfigured Scheduled Searches that are missing data based on its schedule and time range
- Illuminates misconfigured Scheduled Searches that are producing overlapping searches on data, possibly wasting system resources.
- Provides tools to investigate searches further and edit their SPL if necessary.
- Automation to easily fix any identified search in 2 button clicks, to catch missing data or reduce overlapping time ranges.
- Identifies orphaned searches and provides an automated process to reassign them to active Splunk owners.
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.