SPL
skipped searches and why
Description
Quickly identify high amounts of skipped searches in your cluster or standalone SH(s):
6 0
index = _internal skipped sourcetype=scheduler status=skipped host=[your splunk SH(s)] | stats count by app search_type reason savedsearch_name | sort -countAdjust "[your splunk SH(s)]" to the SH(s) you want to check obviously ;)
Comments
0 total
Be the first to comment on this SPL.
Leave a comment
You must log in to post a comment.