Skipped searches

[bosseres]

Hello, community

What's skipped search? Do I understand correctly that it's a search which finished with error?

How can I generate skipped search (weird task, but I have)

Thank you.

[venkatasri]

Hi @bosseres 

Same has been explained here in detail - 

How to avoid skipped scheduled searches in a clust... - Splunk Community

Skipped Saved Searches - Splunk Community

SPL you can run to find skipped searches,  You can extend the search by applying a filter with  log_level=WARN OR log_level=ERROR to find possible issues with searches.

index=_internal source="*scheduler.log" status="skipped" 
| table _time savedsearch_id user app

---

An upvote would be appreciated and Accept solution if this reply helps!

[bosseres]

Hello and thank you for your answer!

I know how to look skipped searches, but I have the opposite task. I need to understand what is it (skipped search) and generate it.