Reporting

In the scheduler.log, what does status=continued mean?

sowings
Splunk Employee
Splunk Employee

I see a number of events in my scheduler.log that have the string "status=continued" in them. Further, these entries lack the run_time (and other fields) that would seem to indicate successful saved search completion. What do these log events represent?

Tags (1)

wsnyder2
Path Finder

Can we assume that status=skipped is a "not" so good thing?

0 Karma

somesoni2
Revered Legend

In my understanding, when a search is configured for continuous scheduling (realtime_schedule = 0) and no of concurrent searches exceeds the limit, Splunk will add an entry with status=continued as the search execution is queued up. It should log another entry with status=success or status=fail when search is executed after it's turn comes up.

0 Karma

jluste
Path Finder

I'd also like to know what continued means officially and if it is the case of a deferred search, how long goes by before that search gets set to status=skipped?

0 Karma

sowings
Splunk Employee
Splunk Employee

My observation is that it's when a prior instance of the search is running, but the time has come for it to run again.

If anyone has an updated answer, I'd appreciate it.

mloven_splunk
Splunk Employee
Splunk Employee

bumping this. I'd like to know as well.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!