Correlation Searches displaying 'Next Scheduled Time' in the past

Applicability

Description

When viewing the 'Next Scheduled Time' column on Configure > Content Management the date and time displayed is before the current date and time.

Investigation

Checking the scheduler logs with the following search:

index=_internal sourcetype=scheduler (skipping OR status=skipped) savedsearch_name=<Correlation Search name>

There are messages like:

status=continued, reason="user=<username> is not allowed to run historical scheduled search, skipping"

This message indicates that the user does not have permission to run saved searches.

Resolution

A minimum requirement is that the owner of the Correlation Search (this can be checked from Settings > Searches, Reports & Alerts) has the 'schedule_search' permission.

By default Power and Admin roles have this capability: Rolesandcapabilities

It is recommended to use a service account to create Correlation Searches so that they do not become orphaned if a user leaves.

If a user does leave the orphaned searches can be reassigned using the following documentation: Resolveorphanedsearches