Splunk Enterprise

monitor failed jobs

sarit_s
Communicator

Hello

i want to create a dashboard that monitors the failed job (savedsearches the i can see in the activity page)

how can search for failed jobs ? 
i saw that ITSI can do it but i wonder if there is a way to do it with Splunk itself

 

thanks

Labels (1)
0 Karma
1 Solution

inventsekar
Super Champion

Check...

 | rest /services/search/jobs | where isFailed=1

Or

| rest /services/search/jobs | search isFailed=1

 

PS - Karma points are appreciated, if a reply solved your problem, please accept it as the solution. 

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.

View solution in original post

inventsekar
Super Champion

Hi Sarit, Please check these search queries:

| rest /services/search/jobs
| table dispatchState *.search

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

sarit_s
Communicator

the first one looks close to what i want. is there a way to filter so i will see only failed jobs ?

0 Karma

inventsekar
Super Champion

| rest /services/search/jobs isFailed=1

this will list only failed jobs. 

 

if this solved your query, please accept this as the solution.  

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

sarit_s
Communicator

well, there is something weird

even thought im searching for isFailed=1 im getting results of isFailed=0

image below

0 Karma

inventsekar
Super Champion

Check...

 | rest /services/search/jobs | where isFailed=1

Or

| rest /services/search/jobs | search isFailed=1

 

PS - Karma points are appreciated, if a reply solved your problem, please accept it as the solution. 

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.

inventsekar
Super Champion

i assumed that "failed jobs" meaning, some app related failed jobs. 

for splunk's failed jobs, 

Splunk GUI---->Activity---> Jobs---> Status dropdown, select Failed.

or, the page URL is(pls update your splunk link on this below URL)

https://yourcompany.splunk.com/en-US/app/search/job_manager?owner=&jobStatus=failed

 

 

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

sarit_s
Communicator

I know it is there

i want to monitor this jobs and add it as dashboard panel

is there a query that can give me the results ?

0 Karma

inventsekar
Super Champion

Hi @sarit_s by Splunk also, its possible. 

the applications logs are already ingested to splunk, we hope. and if you are not sure how to search for the failed jobs, then, maybe, you start from the hostname. simply search for the host which is running the app. 

then, from the events list, you can find out the source/sourcetype. you may need to do field extractions using the rex command. 

let us know how your search goes, so that we can help you. thanks. 

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

sarit_s
Communicator

In the jobs list i see the inpect job option. I see there field name dispatchedStatus but i cant search for it

 

is there a way to search something like this ?

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...