Deferred Searches: | rest /servicesNS/-/-/search/jobs splunk_server=local | search dispatchState="DEFERRED" isSavedSearch=1 | search title IN ("*outputcsv*","*outputlookup*","*collect*") | table label dispatchState reason published updated title Skipped Search: index=_internal sourcetype=scheduler status=skipped [| rest /servicesNS/-/-/saved/searches splunk_server=local | search search IN ("*outputcsv *" ,"*outputlookup *" ) | table title | rename title as savedsearch_name] | stats count by app search_type reason savedsearch_name | sort - count Searches ran with error: | rest /servicesNS/-/-/search/jobs splunk_server=local | search isSavedSearch=1 isFailed=1 | search title IN ("*outputcsv*","*outputlookup*","*collect*") | table label dispatchState reason published updated messages.fatal title Saved Search with collect command generated 0 events: index=_internal sourcetype=scheduler result_count=0 [| rest /servicesNS/-/-/saved/searches splunk_server=local | search search="*collect*" | table title | rename title as savedsearch_name] | table _time user app savedsearch_name status scheduled_time run_time result_count | convert ctime(scheduled_time)
... View more