Reporting

how to find out why the scheduled search is failing to pull the required information from the source ?

Hemnaath
Motivator

Hi Team,

I have noticed that one of the scheduled search failed to pull the information from the AD, so wanted to investigate why it was failed to pull the information. But not sure how to start the investigation, I mean from where I can see the Error related to this.

Kindly guide me on this.

0 Karma

mayurr98
Super Champion

hey @Hemnaath

Try this:

 index=_internal source="*scheduler.log"

this will bring up all information about the scheduled searches. You can find more information on other Splunk internal messages if you leave the source from the search.
Also you can increase logging channels to get more detailed messages back http://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Enabledebuglogging

I hope that helps !

0 Karma

Hemnaath
Motivator

Hi Mayurr, thanks for your effort on this, I had tried the above search and i could see only the info message available in the log_level filed. So could you please let me how to find out why the search had failed to pull the information from the AD.

thanks in advance.

0 Karma

mayurr98
Super Champion

are you getting the data with the same search query which you are using for schedule search?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...