Any way to notify users when their scheduled searches fail?

[kausar]

Is there a way to send the users (and admin too) email notification when their scheduled searches fail e.g. due to quota issue? Error - "Search not executed: Your maximum number of concurrent searches has been reached."

[somesoni2]

A search like this can get you started. This give the list of scheduled search execution failures with user information. You can then set this up as per result alert OR add sendemail command and use the user field to notify user.

index=_internal sourcetype=scheduler NOT (status=success OR status=delegate*) | rex field=savedsearch_id "^(?<user1>[^\;]+)"| table _time savedsearch_id user* message _raw | eval user=coalesce(user,user1)

You may have to join it with this query to get the email.

| rest /services/authentication/users splunk_server=local | table title email | rename title as user

[kausar]

Thanks but I want to put a monitoring in place and this would again be set as a scheduled search. Scheduling a search to detect failed scheduled searches is not a good idea... hoping to see it as an option during scheduled search configuration that when checked notify users if it fails to run. Would that be a feature request?

[aaraneta_splunk]

Hello @kauser - In case you were not able to find your answer and to suggest a feature request, it is recommended that you create a support ticket: http://www.splunk.com/r/bugs
You can choose the "All enhancement requests" under "Splunk installation is" section.
Thank you!