@SamHTexas you can look at index=_internal (sourcetype=splunkd OR sourcetype=scheduler) log_level="ERROR" to see all failures in the correlation search due to issues in macros or lookups. You can then tune the SPL as needed for your environment. Hope this helps.
Something like this will do in Splunk Core or ES.
index=_internal (sourcetype=splunkd OR sourcetype=scheduler) log_level="ERROR" |rex field=_raw "savedsearch=(?<mysaved_search>.+) err=" | rex field=_raw "savedsearch_id=\"(?<mysavedsearch>.+)\", message=\"Error" | stats count by host, mysaved_search
You can then adjust as per your setup and perhaps setup an alert/correlation search to show you errors from macros/lookups within the correlation search in ES.
how can check only skipped correlation search in splunk spl query
index=notable sourcetype=scheduler status!=success
| stats count as skipped_count by search_type user app savedsearch_name status
with this query i am getting all the skipped searches
could you help me on this