How to fetch the list of errors and their details while running SPL which does not allow users to fetch data?

[Taruchit]

Hi All,

I need your help to determine the details of issues which affect users while running SPL.

The details may include errors, their respective SPL, date-timestamp of occurrence and any other information that can be fetched and used to resolve those issues.

So, far I have tried the below: -

1. Fetching the saved search name and their errors

"index=_internal source=*scheduler.log search_type=scheduled |stats count BY savedsearch_name, reason"

2. Fetching list of errors for all saved searches

"index=_internal source=*scheduler.log search_type=scheduled |stats count BY reason"

Is there any other SPL that can be built and used to get more errors which are not covered by the above?
For example, errors such as: -

Scheduled searches with syntax errors
Corrupted data

And, how to fetch errors for SPLs which are executed by end users on ad-hoc basis?

Additionally, it would be helpful if you could share the approach to determine which index fails the most over a period of time.

Thank you

[Taruchit]

I tried some of the below SPLs to get list of errors for ad-hoc searches: -

SPL 1: - index="_internal" component="SearchMessages" log_level="ERROR" |stats count BY message

SPL 2: - index="_internal" component="SearchMessages" log_level="WARN" |stats count BY message

With the above two SPLs, I get errors such as: -

Field 'domain' does not exist in the data.

Search was canceled.

Please share if there is any more information that can be fetched with the above two SPLs.

Thank you