(A customer creates a saved search that runs on a specific interval. Which internal Splunk log should be viewed to determine if the search ran recently?)

Question

Options

• Ametrics.log
• Bkvstore.log
• Cscheduler.log
• Dbtool.log

• A
  4% (2)
• B
  2% (1)
• C
  93% (53)
• D
  2% (1)

Explanation

According to Splunk's Search Scheduler and Job Management documentation, the scheduler.log file, located within the _internal index, records the execution of scheduled and saved searches. This log provides a detailed record of when each search is triggered, how long it runs, and its success or Each time a scheduled search runs (for example, alerts, reports, or summary index searches), an entry is written to scheduler.log with fields such as: sid (search job ID) savedsearch_name (name of the saved search) status (success, skipped, or failed) run_time and result_count By searching the _internal index for sourcetype=scheduler (or directly viewing scheduler.log), administrators can confirm whether a specific saved search executed as expected and diagnose skipped or delayed runs due to resource contention or concurrency limits. Other internal logs serve different purposes: metrics.log records performance metrics. kvstore.log tracks KV Store operations. btool.log does not exist - btool outputs configuration data to the console, not a log file. Hence, scheduler.log is the definitive and Splunk-documented source for validating scheduled search - Saved Searches and Alerts - Scheduler Operation Details - scheduler.log Reference - Monitoring Scheduled Search Execution - Monitoring Console: Search Scheduler Health Dashboard - Troubleshooting Skipped or Delayed Scheduled Searches

No community discussion yet for this question.