Looking at scheduler.log from a search head cluster member, the scheduler.log has a status column that can have following values:
delegated_remote
delegated_remote_completion
d...
Hi ,
One of the scheduled search fails at the time9and even changed) with this error in scheduler.log
status=delegated_remote_error
Pls help
Regards
Shrdadha
...umber of savedsearches that trigger on cron (every 5m, 15m, 30m, 1h etc) and we are working to minimise the concurrency by introducing Scheduler Window & Skew. I know exactly which searches are t...
We have a log of saved searches working simultaneously in our search head. Around 70% of which are resulting status= Continued.
What does it mean, does it affect the alerts that we have created, d...
Dear Splunk Community,
I need to connect with IBM tool TWS (Tivoli Work Scheduler) using SPLUNK to get the real-time status of jobs and through dashboards.
Currently, we use another IBM tool J...
...ran was:
index=_internal sourcetype=scheduler savedsearch_name="" |stats min(_time) as _time values(status) as status by sid | search status!="success" | sort - _time
Referring to the post b...
If looking at scheduler log from a single search head in the search head cluster, what does status=delegated_remote OR status=delegated_remote_completion mean? Does it mean that the search that was r...
Hi
Is there some place in Splunk Docs where I can find the definition of the field status in _internal log , source type scheduler ?
I have some searches with value null for that field but I a...