Reporting

how to find out why the scheduled search is failing to pull the required information from the source ?

Hemnaath
Motivator

Hi Team,

I have noticed that one of the scheduled search failed to pull the information from the AD, so wanted to investigate why it was failed to pull the information. But not sure how to start the investigation, I mean from where I can see the Error related to this.

Kindly guide me on this.

0 Karma

mayurr98
SplunkTrust
SplunkTrust

hey @Hemnaath

Try this:

 index=_internal source="*scheduler.log"

this will bring up all information about the scheduled searches. You can find more information on other Splunk internal messages if you leave the source from the search.
Also you can increase logging channels to get more detailed messages back http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Enabledebuglogging

I hope that helps !

0 Karma

Hemnaath
Motivator

Hi Mayurr, thanks for your effort on this, I had tried the above search and i could see only the info message available in the log_level filed. So could you please let me how to find out why the search had failed to pull the information from the AD.

thanks in advance.

0 Karma

mayurr98
SplunkTrust
SplunkTrust

are you getting the data with the same search query which you are using for schedule search?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!