Archive
Highlighted

searchs that does not succeed

Loves-to-Learn

Hello,
I would like to know how to find searchs that do not succeed (no results or with errors) ?
Some users complains about the fact that searchs does not give any results, and I would like to find if there is a search to find these errors (are there any errorcode to find, or else ?)
Thank you

0 Karma
Highlighted

Re: searchs that does not succeed

Motivator

If you have a DMC there are dashboards to show you this type of information, but from a SH you can use something like this:

index=_internal sourcetype=scheduler (status="skipped" OR status="deferred")  
0 Karma
Highlighted

Re: searchs that does not succeed

Loves-to-Learn

Hello Codebuilder,

The error would come from manual searches not from scheduler. In Dmc you talk about scheduled searches skipped ? or something else. I'm searching for manual searches in error.

Thank you

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.