Splunk Search
Highlighted

Missing status for scheduled jobs in scheduler.log

Explorer

Hi all,

I have a SHC in my environment. Today I was troubleshooting an issue where my alert action wasn't firing. After some investigation into the scheduler.log, I found that for the specific search which it wasn't firing, it didn't have an "outcome" status, e.g. skipped, success. The status(es) of the particular sid has only "delegatedremote" and "delegatedremote_completion". The search I ran was:

index=internal sourcetype=scheduler savedsearchname="" |stats min(_time) as _time values(status) as status by sid | search status!="success" | sort - _time

Referring to the post below,

https://answers.splunk.com/answers/217666/what-does-statusdelegated-remote-or-statusdelegate.html

"delegatedremote" and "delegatedremote_completion" are generated from the captain as it tries to delegate to job to SH member.

May I know what it implies if a search doesn't have a status? Thanks in advance!

0 Karma