We recently encountered an issue with a search that returned this error message:
While the fix was fairly simple, we would like to be notified when this type of issue starts in the future. I checked all of the index="_*" logs, and I do not see the error message. Is there a way for me to enable logging for this type of problem?
Have you tried looking at the S.o.S. App (Splunk on Splunk)... this is a diagnostics App for your Splunk installation there are a lot of useful searches/views here.
The S.o.S app can be found here... S.o.S - Splunk on Splunk on Splunkbase
This is an App created by Splunk themselves, and is very helpful for multiple troubleshooting tools. It builds on the information from your installation (conf files, logs, etc.).
answered 28 Dec '11, 09:29
answered 28 Dec '11, 12:44