topic Why does my scheduled saved search randomly decide to return no results? in Splunk Enterprise

Why does my scheduled saved search randomly decide to return no results?

andrewtrobec — Tue, 30 Jun 2020 08:13:03 GMT

Hello!

I noticed that one of my scheduled saved searches randomly refuses to return results. I can run the search at any point from the search bar and get data, even immediately after the scheduled saved search returns 0. Here are the results of when it was scheduled at 2 and 5 minute intervals:

Randomly it will conclude with 0 results after a second with no errors.

Why would it do this? How can I ensure that the results are produced consistently each time?

Thanks!

Andrew

Re: Why does my scheduled saved search randomly decide to return no results?

anilchaithu — Tue, 30 Jun 2020 19:59:38 GMT

@andrewtrobec

Did you check search.log for any errors?

Re: Why does my scheduled saved search randomly decide to return no results?

andrewtrobec — Wed, 01 Jul 2020 06:58:25 GMT

@anilchaithu

Thanks for the reply. The search.log logs do not contain any errors, but when I compare them for an execution that contains results (successful) vs. an execution that does not contain results (failed), I see the following differences:

successful execution sets user context before the following line, the failed execution sets it afterwards:

07-01-2020 06:00:07.397 INFO SearchParser - PARSING: | streamnoop

successful execution has the following line more than 150 times, the failed execution has it twice:

07-01-2020 05:50:04.890 INFO SearchEvaluator - using old evaluator

successful execution has the following line as the final line in the log, the failed execution does not:

07-01-2020 05:51:43.061 INFO PipelineComponent - Process delayed by 97.988 seconds, perhaps system was suspended?

Other than that they're pretty much the same.

Regards,

Andrew