skipped searches and why

Quickly identify high amounts of skipped searches in your cluster or standalone SH(s):

index = _internal skipped sourcetype=scheduler status=skipped host=[your splunk SH(s)] 
| stats count by app search_type reason savedsearch_name 
| sort -count

Adjust “[your splunk SH(s)]” to the SH(s) you want to check obviously ;)

Share This:

Leave A Comment?