Hello, community
What's skipped search? Do I understand correctly that it's a search which finished with error?
How can I generate skipped search (weird task, but I have)
Thank you.
Hi @bosseres
Same has been explained here in detail -
How to avoid skipped scheduled searches in a clust... - Splunk Community
Skipped Saved Searches - Splunk Community
SPL you can run to find skipped searches, You can extend the search by applying a filter with log_level=WARN OR log_level=ERROR to find possible issues with searches.
index=_internal source="*scheduler.log" status="skipped"
| table _time savedsearch_id user app
---
An upvote would be appreciated and Accept solution if this reply helps!
Hello and thank you for your answer!
I know how to look skipped searches, but I have the opposite task. I need to understand what is it (skipped search) and generate it.