Splunk Search

What is scheduler log event status=Continued ?

nishantkumar007
New Member

We have a log of saved searches working simultaneously in our search head. Around 70% of which are resulting status= Continued.

What does it mean, does it affect the alerts that we have created, does it mean they were not able to finish properly and hence the alerts are not getting triggered properly.
thanks

0 Karma

sbhale
Explorer

status=Continued means that splunk was unable to run your search as scheduled, But it will catch up and run it for the time period it was supposed to run.
For example your search looking at data from 00:15 - 00:30 was supposed to run at 00:30. But it got the above status.
What splunk will do is run the search for the timeframe 00:15-00:30 at say 00:40. So the results will(mostly) be the same. I say mostly because you can have data show up later and the results may differ because of that.
Splunk will choose to continue searches that are meant to fill summary data etc which can be more flexible than say alerts.

0 Karma

somesoni2
Revered Legend
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...