Splunk Search

Missing status for scheduled jobs in scheduler.log

johannthum
Explorer

Hi all,

I have a SHC in my environment. Today I was troubleshooting an issue where my alert action wasn't firing. After some investigation into the scheduler.log, I found that for the specific search which it wasn't firing, it didn't have an "outcome" status, e.g. skipped, success. The status(es) of the particular sid has only "delegated_remote" and "delegated_remote_completion". The search I ran was:

index=_internal sourcetype=scheduler savedsearch_name="" |stats min(_time) as _time values(status) as status by sid | search status!="success" | sort - _time

Referring to the post below,

https://answers.splunk.com/answers/217666/what-does-statusdelegated-remote-or-statusdelegate.html

"delegated_remote" and "delegated_remote_completion" are generated from the captain as it tries to delegate to job to SH member.

May I know what it implies if a search doesn't have a status? Thanks in advance!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...