Hello,
I would like to know how to find searchs that do not succeed (no results or with errors) ?
Some users complains about the fact that searchs does not give any results, and I would like to find if there is a search to find these errors (are there any errorcode to find, or else ?)
Thank you
Hello Codebuilder,
The error would come from manual searches not from scheduler. In Dmc you talk about scheduled searches skipped ? or something else. I'm searching for manual searches in error.
Thank you
If you have a DMC there are dashboards to show you this type of information, but from a SH you can use something like this:
index=_internal sourcetype=scheduler (status="skipped" OR status="deferred")