Scheduling Assistant is a powerful tool for improving Splunk environments and reducing concurrency issues and the headaches that brings to many environments. Follow these tips to fully utilize Scheduling Assistant!
- Master the ‘Admin Bump’
- Need help with putting down a new Cron Schedule on a search? Master the Admin Bump! Take a current cron schedule such as ‘0,15,30,45 * * * *’, which runs every 15 minutes, and add around 2-4 minutes on each mark, so it turns into ‘2,17,32,47 * * * *’. Use the Scheduling Assistant to ensure this new ‘bumped’ schedule is actually good for the environment and enact it!
- Most Harm, Best Results
- Unsure on where to start? Find the search with the highest skipped rate, or longest run time, and give the search the time and solitude it needs to perform its advanced search. This will ensure it won’t cause other searches to skip while it takes its time. Use Scheduling Assistant to ensure its new schedule remains the same cadence but is cleared of other searches!
- Lower those Mountain Ranges!
- Using the Time Chart, find patterns of spikes and identify what searches are part of these ‘mountain ranges’ of limit breaking spikes. Use the Scheduling Assistant to push these searches down the timeline and turn the peaks and valleys into nice rolling hills!