Splunk Search

i crafted these searches how can i add specific filters

ustng1
New Member

 

Deferred Searches:

 

| rest /servicesNS/-/-/search/jobs splunk_server=local

| search dispatchState="DEFERRED" isSavedSearch=1

| search title IN ("*outputcsv*","*outputlookup*","*collect*")

| table label  dispatchState reason published updated title

Skipped Search:

 

index=_internal sourcetype=scheduler status=skipped

    [| rest /servicesNS/-/-/saved/searches splunk_server=local

    | search search IN ("*outputcsv *" ,"*outputlookup *" )

    | table title

    | rename title as savedsearch_name]

| stats count by app search_type reason savedsearch_name

| sort - count

Searches ran with error:
 

| rest /servicesNS/-/-/search/jobs splunk_server=local

| search isSavedSearch=1 isFailed=1

| search title IN ("*outputcsv*","*outputlookup*","*collect*")

| table label dispatchState reason published updated messages.fatal title

Saved Search with collect command generated 0 events:


index=_internal sourcetype=scheduler result_count=0

    [| rest /servicesNS/-/-/saved/searches splunk_server=local

    | search  search="*collect*"

    | table title

    | rename title as savedsearch_name]

| table _time user app savedsearch_name status scheduled_time run_time result_count

|  convert ctime(scheduled_time)

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Each of those searches already has at least one specific filter so you know how to do that.  Please explain exactly what you want from us.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...