Splunk Search

Missing status for scheduled jobs in scheduler.log


Hi all,

I have a SHC in my environment. Today I was troubleshooting an issue where my alert action wasn't firing. After some investigation into the scheduler.log, I found that for the specific search which it wasn't firing, it didn't have an "outcome" status, e.g. skipped, success. The status(es) of the particular sid has only "delegated_remote" and "delegated_remote_completion". The search I ran was:

index=_internal sourcetype=scheduler savedsearch_name="" |stats min(_time) as _time values(status) as status by sid | search status!="success" | sort - _time

Referring to the post below,


"delegated_remote" and "delegated_remote_completion" are generated from the captain as it tries to delegate to job to SH member.

May I know what it implies if a search doesn't have a status? Thanks in advance!

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...