According to Splunk’s Search Scheduler and Job Management documentation, the scheduler.log file, located within the _internal index, records the execution of scheduled and saved searches. This log provides a detailed record of when each search is triggered, how long it runs, and its success or failure status.
Each time a scheduled search runs (for example, alerts, reports, or summary index searches), an entry is written to scheduler.log with fields such as:
sid (search job ID)
app (application context)
savedsearch_name (name of the saved search)
user (owner)
status (success, skipped, or failed)
run_time and result_count
By searching the _internal index for sourcetype=scheduler (or directly viewing scheduler.log), administrators can confirm whether a specific saved search executed as expected and diagnose skipped or delayed runs due to resource contention or concurrency limits.
Other internal logs serve different purposes:
metrics.log records performance metrics.
kvstore.log tracks KV Store operations.
btool.log does not exist — btool outputs configuration data to the console, not a log file.
Hence, scheduler.log is the definitive and Splunk-documented source for validating scheduled search activity.
References (Splunk Enterprise Documentation):
• Saved Searches and Alerts – Scheduler Operation Details
• scheduler.log Reference – Monitoring Scheduled Search Execution
• Monitoring Console: Search Scheduler Health Dashboard
• Troubleshooting Skipped or Delayed Scheduled Searches
