how to find out why the scheduled search is failing to pull the required information from the source ?

[Hemnaath]

Hi Team,

I have noticed that one of the scheduled search failed to pull the information from the AD, so wanted to investigate why it was failed to pull the information. But not sure how to start the investigation, I mean from where I can see the Error related to this.

Kindly guide me on this.

[mayurr98]

hey @Hemnaath

Try this:

 index=_internal source="*scheduler.log"

this will bring up all information about the scheduled searches. You can find more information on other Splunk internal messages if you leave the source from the search.
Also you can increase logging channels to get more detailed messages back http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Enabledebuglogging

I hope that helps !

[Hemnaath]

Hi Mayurr, thanks for your effort on this, I had tried the above search and i could see only the info message available in the log_level filed. So could you please let me how to find out why the search had failed to pull the information from the AD.

thanks in advance.

[mayurr98]

are you getting the data with the same search query which you are using for schedule search?