Hi all,
I have a SHC in my environment. Today I was troubleshooting an issue where my alert action wasn't firing. After some investigation into the scheduler.log, I found that for the specific search which it wasn't firing, it didn't have an "outcome" status, e.g. skipped, success. The status(es) of the particular sid has only "delegated_remote" and "delegated_remote_completion". The search I ran was:
index=_internal sourcetype=scheduler savedsearch_name="" |stats min(_time) as _time values(status) as status by sid | search status!="success" | sort - _time
Referring to the post below,
https://answers.splunk.com/answers/217666/what-does-statusdelegated-remote-or-statusdelegate.html
"delegated_remote" and "delegated_remote_completion" are generated from the captain as it tries to delegate to job to SH member.
May I know what it implies if a search doesn't have a status? Thanks in advance!
