Splunk Search

How to fetch the list of errors and their details while running SPL which does not allow users to fetch data?

Taruchit
Contributor

Hi All,

I need your help to determine the details of issues which affect users while running SPL.

The details may include errors, their respective SPL, date-timestamp of occurrence and any other information that can be fetched and used to resolve those issues.

So, far I have tried the below: -

1. Fetching the saved search name and their errors

"index=_internal source=*scheduler.log search_type=scheduled |stats count BY savedsearch_name, reason"

2. Fetching list of errors for all saved searches

"index=_internal source=*scheduler.log search_type=scheduled |stats count BY reason"

Is there any other SPL that can be built and used to get more errors which are not covered by the above?
For example, errors such as: -

Scheduled searches with syntax errors
Corrupted data

And, how to fetch errors for SPLs which are executed by end users on ad-hoc basis?

Additionally, it would be helpful if you could share the approach to determine which index fails the most over a period of time.

Thank you

Labels (2)
0 Karma

Taruchit
Contributor

I tried some of the below SPLs to get list of errors for ad-hoc searches: -

SPL 1: - index="_internal" component="SearchMessages" log_level="ERROR" |stats count BY message

SPL 2: - index="_internal" component="SearchMessages" log_level="WARN" |stats count BY message

With the above two SPLs, I get errors such as: -

Field 'domain' does not exist in the data.

Search was canceled.

Please share if there is any more information that can be fetched with the above two SPLs.

Thank you

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...