Splunk Search

Looking for a query to display a list of jobs stuck in queue (the past 7 days).

Ninja_splunk
Splunk Employee
Splunk Employee

I'm looking for a query to display a list of jobs stuck in queue (the past 7 days). Does anyone knows the query?

 

Labels (4)
0 Karma

sainag_splunk
Splunk Employee
Splunk Employee

How about something like this to start with?

index=_internal sourcetype=splunkd log_level=WARN host=sh* component=DispatchManager "QUEUED" | stats count by host

 

If this helps, Upvote!!!!
Together we make the Splunk Community stronger 
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...