Filter and Reprocess the List of Batches

Batches can sometimes fail to execute due to an external or systemic issue. For example, if your SIEM application goes down or connection to the application is lost, multiple batches can fail during the period that it is unavailable.

📘

Note

If you see a message that your batches have expired, you can recompute your playbook to re-execute the batches.

Use filtering and reprocessing options to help manage your batches. To view the batches, open the Streams page, and select a stream to display the batches.

If a problem that caused batches to fail has been resolved, you can reprocess the affected batches by selecting the error batches using the checkbox and click on Rerun Error and Cancelled.

You can also exclude batches with errors, or exclude batches that didn't have any events to process. Use the filter options: Status and Exclude Batches with 0 events.

• Click on the Status filter to filter out batches with the listed status. In this example, the error is selected to show all the batches that are in error status.

• Click on Exclude Batches with 0 events to view the events greater than 1.

Select one or both options, and then click Apply to close the window and display the filtered list.