https://community.splunk.com/t5/Splunk-Enterprise/Find-failed-job-reason/m-p/559610#M6412 <P>I want to see any failed job, ad-hoc and scheduled. For instance, I was creating a new search command, and it failed a lot until I got it right. I expect to see the same error, I see in web search, in the logs:</P><UL><LI><U>| rest /servicesNS/-/-/search/jobs</U> shows a handful over 4 hours. There was far more than that.</LI><LI><U>_audit</U> shows plenty of failed searches, but not the reason</LI><LI><U>_internal</U> doesn't show anything useful</LI></UL> Thu, 15 Jul 2021 15:00:07 GMT tmontney 2021-07-15T15:00:07Z https://community.splunk.com/t5/Splunk-Enterprise/Find-failed-job-reason/m-p/559610#M6412 <P>I want to see any failed job, ad-hoc and scheduled. For instance, I was creating a new search command, and it failed a lot until I got it right. I expect to see the same error, I see in web search, in the logs:</P><UL><LI><U>| rest /servicesNS/-/-/search/jobs</U> shows a handful over 4 hours. There was far more than that.</LI><LI><U>_audit</U> shows plenty of failed searches, but not the reason</LI><LI><U>_internal</U> doesn't show anything useful</LI></UL> Thu, 15 Jul 2021 15:00:07 GMT https://community.splunk.com/t5/Splunk-Enterprise/Find-failed-job-reason/m-p/559610#M6412 tmontney 2021-07-15T15:00:07Z https://community.splunk.com/t5/Splunk-Enterprise/Find-failed-job-reason/m-p/559627#M6413 <P>Use the Job Inspector.</P><P><A href="https://docs.splunk.com/Documentation/Splunk/8.2.1/Search/ViewsearchjobpropertieswiththeJobInspector" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.2.1/Search/ViewsearchjobpropertieswiththeJobInspector</A></P> Thu, 15 Jul 2021 15:55:56 GMT https://community.splunk.com/t5/Splunk-Enterprise/Find-failed-job-reason/m-p/559627#M6413 codebuilder 2021-07-15T15:55:56Z https://community.splunk.com/t5/Splunk-Enterprise/Find-failed-job-reason/m-p/559669#M6418 <P>After posting, I ended up with this:</P><LI-CODE lang="markup">| rest /servicesNS/-/-/search/jobs | eval t=strptime(updated, "%Y-%m-%dT%H:%M:%S.%f-%z") | where [ makeresults | addinfo | eval search=" t &gt;= ". info_min_time. if(info_max_time=="+Infinity",""," AND t &lt;= ".info_max_time) ] | eval hadError=case(isFailed=1, 1, isNotNull('messages.error'), 1, 1=1, 0) | search hadError=1 | stats count</LI-CODE> Thu, 15 Jul 2021 18:44:08 GMT https://community.splunk.com/t5/Splunk-Enterprise/Find-failed-job-reason/m-p/559669#M6418 tmontney 2021-07-15T18:44:08Z