topic Re: Report failed schedule report in Reporting

Report failed schedule report

rsathish47 — Mon, 15 Dec 2014 06:10:10 GMT

HI All,

how do we report failed scheduled report/search in splunk.. Please let me know your thoughts .

Thanks
Sathish R

Re: Report failed schedule report

MuS — Mon, 15 Dec 2014 06:52:41 GMT

please provide more details, like do you want to search for searches that literally failed (the search itself?) or do you want to run a search that searches for events that contain the value failed ?

Re: Report failed schedule report

rsathish47 — Mon, 15 Dec 2014 07:33:13 GMT

Errors Like this
An error occurred while generating a PDF of this report
Some times we are not reciveing mail from scheduled search/report

Re: Report failed schedule report

MuS — Mon, 15 Dec 2014 08:07:15 GMT

Hi rsathish47,

check your Splunk logs like this:

index=_internal source="*scheduler.log"

this will bring up all information about the scheduled searches. You can find more information on other Splunk internal messages if you leave the source from the search.
You can find some pdf related messages in python.log for example and you can increase logging channels to get more detailed messages back http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Enabledebuglogging

hope that helps ...

cheers, MuS

Re: Report failed schedule report

jonaclough — Thu, 19 Oct 2023 13:48:24 GMT

Scheduled report:

index=_internal source="*scheduler.log" log_level=ERROR | eval user=mvindex(split(savedsearch_id, ";"), 0) | eval app=mvindex(split(savedsearch_id, ";"), 1) | eval search=mvindex(split(savedsearch_id, ";"), 2) | stats count by user, app , search, message

Failed search:

index=_audit action=search has_error_warn=true fully_completed_search=false