Job is missing Events - Splunk / Splunk ES

When a Job causes a high number of events, it can appear that the integration stops processing subsequence Jobs when in fact the events are still being processed. To determine if this is the case, go to Settings > Integrations and click View Last Query for the integration. If events are still processing, you'll see processing messages, as displayed in the Splunk last query image.

Splunk ES last query showing events still in process

  • May 20, 2022
  • August 24, 2023
In This Article