Find failed job reason

[tmontney]

I want to see any failed job, ad-hoc and scheduled. For instance, I was creating a new search command, and it failed a lot until I got it right. I expect to see the same error, I see in web search, in the logs:

• | rest /servicesNS/-/-/search/jobs shows a handful over 4 hours. There was far more than that.
• _audit shows plenty of failed searches, but not the reason
• _internal doesn't show anything useful

[codebuilder]

Use the Job Inspector.

https://docs.splunk.com/Documentation/Splunk/8.2.1/Search/ViewsearchjobpropertieswiththeJobInspector

[tmontney]

After posting, I ended up with this:

| rest /servicesNS/-/-/search/jobs
| eval t=strptime(updated, "%Y-%m-%dT%H:%M:%S.%f-%z")
| where 
    [ makeresults 
    | addinfo
    | eval search=" t >= ". info_min_time. if(info_max_time=="+Infinity",""," AND t <= ".info_max_time) ]
| eval hadError=case(isFailed=1, 1, isNotNull('messages.error'), 1, 1=1, 0)
| search hadError=1
| stats count