<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Skipped search in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Skipped-search/m-p/697980#M237075</link>
    <description>&lt;OL&gt;&lt;LI&gt;Have you included search head captain in your search? I believe only the scheduler node will get the failed logs. If you have included them, follow my next steps.&lt;BR /&gt;&lt;BR /&gt;&lt;/LI&gt;&lt;LI&gt;Do you find them in your logs and they aren't extracted? Append the below SPL to extract them.&lt;BR /&gt;&lt;BR /&gt;&lt;/LI&gt;&lt;/OL&gt;&lt;LI-CODE lang="markup"&gt;| rex field=_raw "status=(?&amp;lt;status&amp;gt;\w+)"&lt;/LI-CODE&gt;&lt;P&gt;Do you get them when you do stats count on status?&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;If not then you have 100% success rate on the searches.&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Mon, 02 Sep 2024 12:31:22 GMT</pubDate>
    <dc:creator>vigneshnarendra</dc:creator>
    <dc:date>2024-09-02T12:31:22Z</dc:date>
    <item>
      <title>Skipped search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Skipped-search/m-p/697974#M237072</link>
      <description>&lt;P class="lia-align-left"&gt;Hi All,&lt;/P&gt;&lt;P class="lia-align-left"&gt;I am able to see only 4 status, why am I not able to see status=skipped and status = continued&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="VijaySrrie_0-1725276046695.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/32480iB7933E88360FD624/image-size/medium?v=v2&amp;amp;px=400" role="button" title="VijaySrrie_0-1725276046695.png" alt="VijaySrrie_0-1725276046695.png" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Mon, 02 Sep 2024 11:21:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Skipped-search/m-p/697974#M237072</guid>
      <dc:creator>VijaySrrie</dc:creator>
      <dc:date>2024-09-02T11:21:34Z</dc:date>
    </item>
    <item>
      <title>Re: Skipped search</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Skipped-search/m-p/697980#M237075</link>
      <description>&lt;OL&gt;&lt;LI&gt;Have you included search head captain in your search? I believe only the scheduler node will get the failed logs. If you have included them, follow my next steps.&lt;BR /&gt;&lt;BR /&gt;&lt;/LI&gt;&lt;LI&gt;Do you find them in your logs and they aren't extracted? Append the below SPL to extract them.&lt;BR /&gt;&lt;BR /&gt;&lt;/LI&gt;&lt;/OL&gt;&lt;LI-CODE lang="markup"&gt;| rex field=_raw "status=(?&amp;lt;status&amp;gt;\w+)"&lt;/LI-CODE&gt;&lt;P&gt;Do you get them when you do stats count on status?&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;If not then you have 100% success rate on the searches.&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Mon, 02 Sep 2024 12:31:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Skipped-search/m-p/697980#M237075</guid>
      <dc:creator>vigneshnarendra</dc:creator>
      <dc:date>2024-09-02T12:31:22Z</dc:date>
    </item>
  </channel>
</rss>

