Splunk Search

Skipped search

VijaySrrie
Builder

Hi All,

I am able to see only 4 status, why am I not able to see status=skipped and status = continued

VijaySrrie_0-1725276046695.png

 

0 Karma

vigneshnarendra
Explorer
  1. Have you included search head captain in your search? I believe only the scheduler node will get the failed logs. If you have included them, follow my next steps.

  2. Do you find them in your logs and they aren't extracted? Append the below SPL to extract them.

| rex field=_raw "status=(?<status>\w+)"

Do you get them when you do stats count on status? 

If not then you have 100% success rate on the searches. 

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...