Identify and select the Scheduled Search for improvement on the Scheduling Assistant dashboard’s Inventory of Reports table. Review Reduce your Skip Ratio or Average Latency Values of your Health Score or Reduce your Jobs over Concurrency Limits or Overbooked Values of your Health Score for help on selecting or identifying these searches.
After selecting a Scheduled Search, the bottom half of the Scheduling Assistant Dashboard should populate.
The Report Information contains the most recent configurations of the Scheduled Searches. The Concurrently Scheduled Reports Section contains both searches that run at the same time as the selected search, and a metric for how many times they run. Selecting one of these searches will select that search for the Dashboard. Finally, Report Activity shows historical data on how the search operates. Use this information for validating how well searches are performing in the Splunk environment and identifying searches to improve next.
To improve the current selected search, continue down to the Scheduling Settings section.
The ‘Before’ column contains facts on how well the search is operating with its current Cron Schedule. Users can now input any valid Cron schedule into the Cron Schedule input and select ‘Preview’. By selecting ‘Preview’, the report will reload and compare the current Cron Schedule in use, with the inputted cron schedule.
As an example, a new scheduled was inputted that offset this search by 2 minutes. It runs the same number of times in the year (Scheduled Runs per Year), but it brings fantastic improvements to Concurrent Scheduling per Year, Average Concurrency, and Limit Breach Ratio.
Once a new Cron Schedule that improves the environment is found, hitting ‘Save Changes’ will apply the Schedule to the local file and enact its improved scheduling, improving the environment. See Tips and Tricks with Improving Cron Schedules with Scheduling Assistant for some further guidance!