https://community.splunk.com/t5/Monitoring-Splunk/How-to-detect-finalization-of-subsearches/m-p/604157#M9012 <P>Hi all,</P><P>regarding a complete monitoring for our customers we want to detect if a subsearch is finalized.<BR />If this happens the search results of the corresponding main search could be incomplete.<BR />Especially for scheduled searches, where no user gets a feedback, this would be helpful.</P><P>Is there any log channel, where this is logged?<BR />I tried starting splunk in debug-mode but found nothing.</P><P>The only place are the search-logs, but indexing every search-log seems a bit oversized.</P><P>Any one out there who could provide a hint?</P><P>Thanks!</P> Fri, 01 Jul 2022 17:58:49 GMT huszti21 2022-07-01T17:58:49Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-detect-finalization-of-subsearches/m-p/604157#M9012 <P>Hi all,</P><P>regarding a complete monitoring for our customers we want to detect if a subsearch is finalized.<BR />If this happens the search results of the corresponding main search could be incomplete.<BR />Especially for scheduled searches, where no user gets a feedback, this would be helpful.</P><P>Is there any log channel, where this is logged?<BR />I tried starting splunk in debug-mode but found nothing.</P><P>The only place are the search-logs, but indexing every search-log seems a bit oversized.</P><P>Any one out there who could provide a hint?</P><P>Thanks!</P> Fri, 01 Jul 2022 17:58:49 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-detect-finalization-of-subsearches/m-p/604157#M9012 huszti21 2022-07-01T17:58:49Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-detect-finalization-of-subsearches/m-p/604159#M9014 <P>Correct me if I'm wrong but I don't think there's reliable way to detect such things. That's why using subsearches in situations when they can "runaway" to such big result sets is highly discouraged and such searches should be reconsidered and possibly redesigned to use other means of getting same results.</P> Fri, 01 Jul 2022 18:22:20 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-detect-finalization-of-subsearches/m-p/604159#M9014 PickleRick 2022-07-01T18:22:20Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-detect-finalization-of-subsearches/m-p/604261#M9022 <P>SearchHeadLevel - Users with auto-finalized searches</P><P>Is the savedsearch name I use in Alerts for Splunk Admins, refer to&nbsp;<A href="https://raw.githubusercontent.com/gjanders/SplunkAdmins/master/default/savedsearches.conf" target="_blank">https://raw.githubusercontent.com/gjanders/SplunkAdmins/master/default/savedsearches.conf</A>&nbsp;or the full app&nbsp;<A href="https://splunkbase.splunk.com/app/3796/" target="_blank">https://splunkbase.splunk.com/app/3796/</A></P><P>You will need to enable splunk search messages,&nbsp;limits.conf setting log_search_messages=true</P> Sun, 03 Jul 2022 08:20:27 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-detect-finalization-of-subsearches/m-p/604261#M9022 gjanders 2022-07-03T08:20:27Z