WARN: "summary indexing dispatch key = test_user;search;test_search_app not found"

Available Languages

Updated:September 29, 2026

Document ID:SPLK046223

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise Splunk Cloud

Description

After upgrading to Splunk versions 8.1.0, 8.1.1 and 8.1.2 users may notice the following type of warning messages in the scheduler.log:

WARN  SavedSplunker - summary indexing dispatch key = test_user;search;test_search_app not found

Investigation

This is a known issue

Support Advisory: SHC on 8.1.0 to 8.1.2 will see a surge in search load at captaincy switches because previous savedsearches will rerun.

A regression was introduced in 8.1.0 (also present in 8.1.1 and 8.1.2) impacting Search Head Clusters by breaking the delegation and execution of Continuous Scheduled Searches and Reports accelerations. This is due to the communication between Captain and members being broken not allowing the Captain to schedule and advance the runtime of searches correctly.

This will consequently lead to the rescheduling of searches, potentially overwhelming of the SHC in case of captaincy change.

Resolution

To fix the issue you need to upgrade to 8.1.3 (or later versions).

If you can't yet upgrade and are still running affected versions, set a preferred captain to avoid the scenario of captaincy change and consequent reschedule of searches that can overwhelm the SHC.

Note: setting a preferred captain will not solve the issue of allowing searches to be scheduled incorrectly.

Control captaincy