topic Re: Reporting on search errors in Reporting

Reporting on search errors

jamesdon — Wed, 28 Dec 2011 13:59:17 GMT

Hello,

We recently encountered an issue with a search that returned this error message:

[subsearch]: File '/opt/splunk/var/run/splunk/file_name.csv' could not be opened for reading.

While the fix was fairly simple, we would like to be notified when this type of issue starts in the future. I checked all of the index="_*" logs, and I do not see the error message. Is there a way for me to enable logging for this type of problem?

Thank you,

Jim

Re: Reporting on search errors

MHibbin — Wed, 28 Dec 2011 17:29:11 GMT

Have you tried looking at the S.o.S. App (Splunk on Splunk)... this is a diagnostics App for your Splunk installation there are a lot of useful searches/views here.

The S.o.S app can be found here... http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk

This is an App created by Splunk themselves, and is very helpful for multiple troubleshooting tools. It builds on the information from your installation (conf files, logs, etc.).

Regards,

MHibbin

Re: Reporting on search errors

jamesdon — Mon, 28 Sep 2020 10:15:00 GMT

The SOS App uses logs in the _internal index, which I was searching before. However, when I looked again with a looser search, I found the cause - but not the error seen in the web browser. I'll play around with alerting based on log_level.

Thank you!

Re: Reporting on search errors

mayler — Wed, 28 Dec 2011 20:44:46 GMT

check web_service.log

Re: Reporting on search errors

MHibbin — Wed, 28 Dec 2011 22:08:58 GMT

Jamesdon,

Good luck with this. I don't think you will always see the same error as in the logs... normally the logs would be for a "techie" and the web errors in a more human readable manner (for the general user)... As you probably already know 😛

Regards,

MHibbin