https://community.splunk.com/t5/Splunk-Enterprise-Security/Need-help-to-add-a-field-to-my-SPL-to-list-reason-for-Failed/m-p/562807#M10195 <P class="yiv9403532516MsoNormal">I run the following to get a list of Saved / skipped searches thru the Monitoring console for my ES (Splunk ES). I need a field added to show the reason for failure / why skipped the searches. Thanks a million in advance for your help.</P><P class="yiv9403532516MsoNormal">&nbsp;</P><P class="yiv9403532516MsoNormal">`dmc_set_index_internal` search_group=dmc_group_search_head search_group=* sourcetype=scheduler (status="completed" OR status="skipped" OR status="deferred")&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; | stats count(eval(status=="completed" OR status=="skipped")) AS total_exec, count(eval(status=="skipped")) AS skipped_exec by _time, host, app, savedsearch_name, user, savedsearch_id | where skipped_exec &gt; 0</P><P class="yiv9403532516MsoNormal">&nbsp;</P> Tue, 10 Aug 2021 20:13:51 GMT SamHTexas 2021-08-10T20:13:51Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Need-help-to-add-a-field-to-my-SPL-to-list-reason-for-Failed/m-p/562807#M10195 <P class="yiv9403532516MsoNormal">I run the following to get a list of Saved / skipped searches thru the Monitoring console for my ES (Splunk ES). I need a field added to show the reason for failure / why skipped the searches. Thanks a million in advance for your help.</P><P class="yiv9403532516MsoNormal">&nbsp;</P><P class="yiv9403532516MsoNormal">`dmc_set_index_internal` search_group=dmc_group_search_head search_group=* sourcetype=scheduler (status="completed" OR status="skipped" OR status="deferred")&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; | stats count(eval(status=="completed" OR status=="skipped")) AS total_exec, count(eval(status=="skipped")) AS skipped_exec by _time, host, app, savedsearch_name, user, savedsearch_id | where skipped_exec &gt; 0</P><P class="yiv9403532516MsoNormal">&nbsp;</P> Tue, 10 Aug 2021 20:13:51 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Need-help-to-add-a-field-to-my-SPL-to-list-reason-for-Failed/m-p/562807#M10195 SamHTexas 2021-08-10T20:13:51Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Need-help-to-add-a-field-to-my-SPL-to-list-reason-for-Failed/m-p/562829#M10196 <P>The <FONT face="courier new,courier">stats</FONT> command strips out all of the fields not referenced in the command.&nbsp; If you re-run the query using only the part before the first pipe then you'll see the field you seek.&nbsp; Add it to the <FONT face="courier new,courier">by</FONT> clause of the <FONT face="courier new,courier">stats</FONT> command.</P> Wed, 11 Aug 2021 00:05:33 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Need-help-to-add-a-field-to-my-SPL-to-list-reason-for-Failed/m-p/562829#M10196 richgalloway 2021-08-11T00:05:33Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Need-help-to-add-a-field-to-my-SPL-to-list-reason-for-Failed/m-p/563882#M10213 <P>I thank u for your message. I tried to follow what you stated but did not see the result I wanted. Please show me what part of my SPL listed I should be running to receive what you stated. Thank u</P> Thu, 19 Aug 2021 02:32:09 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Need-help-to-add-a-field-to-my-SPL-to-list-reason-for-Failed/m-p/563882#M10213 SamHTexas 2021-08-19T02:32:09Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Need-help-to-add-a-field-to-my-SPL-to-list-reason-for-Failed/m-p/563947#M10214 <LI-CODE lang="markup">`dmc_set_index_internal` search_group=dmc_group_search_head search_group=* sourcetype=scheduler (status="completed" OR status="skipped" OR status="deferred") | stats count(eval(status=="completed" OR status=="skipped")) AS total_exec, count(eval(status=="skipped")) AS skipped_exec by _time, host, app, savedsearch_name, user, savedsearch_id, reason | where skipped_exec &gt; 0</LI-CODE> Thu, 19 Aug 2021 12:31:03 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Need-help-to-add-a-field-to-my-SPL-to-list-reason-for-Failed/m-p/563947#M10214 richgalloway 2021-08-19T12:31:03Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Need-help-to-add-a-field-to-my-SPL-to-list-reason-for-Failed/m-p/563963#M10215 <P>Happy Thursday &amp; Thank u sir for your help. Stay safe &amp; blessed.</P> Thu, 19 Aug 2021 14:46:03 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Need-help-to-add-a-field-to-my-SPL-to-list-reason-for-Failed/m-p/563963#M10215 SamHTexas 2021-08-19T14:46:03Z