topic Problem with a query in Splunk Enterprise Security

Problem with a query

havatz — Sun, 04 Oct 2020 21:59:30 GMT

Need you help please with a query;

"| tstats summariesonly=true allow_old_summaries=true dc(Malware_Attacks.date) as \"day_count\",count from datamodel=Malware.Malware_Attacks by \"Malware_Attacks.dest\",\"Malware_Attacks.signature\" | rename \"Malware_Attacks.dest\" as \"dest\",\"Malware_Attacks.signature\" as \"signature\" | search dest=\"10.0.0.0/8\" OR dest=\"192.168.0.0/15\" OR dest=\"172.16.0.0/12\"\n| where 'day_count'>3"

I got an errors:

"type": "ERROR",
"text": "[idx-indexname.splunkcloud.com] The search process with search_id=\"remote_sh-i-idx-indexname.splunkcloud.com_1\" may have returned partial results. Try running your search again. If you see this error repeatedly, review search.log for details or contact your Splunk administrator."

How can I fix that?

thanks

Re: Problem with a query

Richfez — Mon, 05 Oct 2020 00:47:08 GMT

Well. I assume you have tried running it again and that it still fails?

This is usually caused by some sort of environmental problem. Check your indexer cluster's status

https://docs.splunk.com/Documentation/Splunk/8.0.6/DistSearch/Viewsearchpeers

And ... resolve as required.

If you don't see problems over all the things, then it could just be a 'datamodel gone wild' so you could try rebuilding your Malware datamodel.

Also, you could check with your Splunk administrator and see what they say.

Happy Splunking!

-Rich

Re: Problem with a query

ololdach — Mon, 05 Oct 2020 06:55:16 GMT

Hi, when my searches fail or show errors I always open the Job Inspector. In the Inspector popup window, there is another link to the search.log that gives you some very detailed information. Another way to see more info about your errors is to open a plain search window and do a search like:

index=_internal error

Oliver