https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-search-error-message/m-p/495951#M8585 <P>I tried but search.log shows only access log.</P> Tue, 12 May 2020 23:57:22 GMT kanam 2020-05-12T23:57:22Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-search-error-message/m-p/495947#M8581 <P>When I search or after running saved search, sometimes error messages are displayed,<BR /> however activity log shows they have been completed.<BR /> "Dispatch Command: Unknown error for indexer: xxxx. Search Results might be incomplete! If this occurs frequently, please check on the peer."</P> <P>I want to search how frequently these message are created.<BR /> Please let me know the way to search.</P> <P>I can't find as below.<BR /> -index=_internal "<EM>dispatch</EM>"<BR /> -index=_internal "<EM>incomplete</EM>"</P> Wed, 30 Sep 2020 05:23:40 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-search-error-message/m-p/495947#M8581 kanam 2020-09-30T05:23:40Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-search-error-message/m-p/495948#M8582 <P>Search <CODE>index=_internal sourcetype=splunkd</CODE> for the name of the indexer.</P> Mon, 11 May 2020 13:48:08 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-search-error-message/m-p/495948#M8582 richgalloway 2020-05-11T13:48:08Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-search-error-message/m-p/495949#M8583 <P>I've tried to search index=_internal sourcertype=splunkd in both SerchHead and Indexer, but I can't find the target error message.</P> Tue, 12 May 2020 00:03:56 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-search-error-message/m-p/495949#M8583 kanam 2020-05-12T00:03:56Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-search-error-message/m-p/495950#M8584 <P>One other place to look is the search.log of any search that displays that message.</P> Tue, 12 May 2020 12:42:02 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-search-error-message/m-p/495950#M8584 richgalloway 2020-05-12T12:42:02Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-search-error-message/m-p/495951#M8585 <P>I tried but search.log shows only access log.</P> Tue, 12 May 2020 23:57:22 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-search-error-message/m-p/495951#M8585 kanam 2020-05-12T23:57:22Z