When I search or after running saved search, sometimes error messages are displayed,
however activity log shows they have been completed.
"Dispatch Command: Unknown error for indexer: xxxx. Search Results might be incomplete! If this occurs frequently, please check on the peer."
I want to search how frequently these message are created.
Please let me know the way to search.
I can't find as below.
-index=_internal "dispatch"
-index=_internal "incomplete"
Search index=_internal sourcetype=splunkd
for the name of the indexer.
I've tried to search index=_internal sourcertype=splunkd in both SerchHead and Indexer, but I can't find the target error message.
One other place to look is the search.log of any search that displays that message.
I tried but search.log shows only access log.