Alerting
Highlighted

Any way to notify users when their scheduled searches fail?

Path Finder

Is there a way to send the users (and admin too) email notification when their scheduled searches fail e.g. due to quota issue? Error - "Search not executed: Your maximum number of concurrent searches has been reached."

0 Karma
Highlighted

Re: Any way to notify users when their scheduled searches fail?

SplunkTrust
SplunkTrust

A search like this can get you started. This give the list of scheduled search execution failures with user information. You can then set this up as per result alert OR add sendemail command and use the user field to notify user.

index=_internal sourcetype=scheduler NOT (status=success OR status=delegate*) | rex field=savedsearch_id "^(?<user1>[^\;]+)"| table _time savedsearch_id user* message _raw | eval user=coalesce(user,user1)

You may have to join it with this query to get the email.

| rest /services/authentication/users splunk_server=local | table title email | rename title as user
Highlighted

Re: Any way to notify users when their scheduled searches fail?

Path Finder

Thanks but I want to put a monitoring in place and this would again be set as a scheduled search. Scheduling a search to detect failed scheduled searches is not a good idea... hoping to see it as an option during scheduled search configuration that when checked notify users if it fails to run. Would that be a feature request?

0 Karma

Re: Any way to notify users when their scheduled searches fail?

Splunk Employee
Splunk Employee

Hello @kauser - In case you were not able to find your answer and to suggest a feature request, it is recommended that you create a support ticket: http://www.splunk.com/r/bugs
You can choose the "All enhancement requests" under "Splunk installation is" section.
Thank you!

0 Karma