topic Re: Question regarding Search Jobs in Splunk Search

Question regarding Search Jobs

misteryuku — Thu, 08 Mar 2012 02:06:36 GMT

What is meant by creating new search job that runs "search error" ?

Re: Question regarding Search Jobs

Masa — Thu, 08 Mar 2012 04:52:30 GMT

Could you describe a litte bit more detail? Step by step what you tried?

Re: Question regarding Search Jobs

Masa — Thu, 08 Mar 2012 06:43:20 GMT

When you run a search, Splunk create a search job. From a process point of view, there is a splunkd child process and its helper process for each search. When a search job is also related to a directory which contains search logs, reults, and meta data. This directory is also called a dispatch directory. The search job's id which is called sid is the search job's dipatch directory.

You can find dispatch jobs under $SPLUNK_HOME/var/run/splunk/dispatch directory. Except for troubleshooting by Support, usueally users never need to go visit there to retrive data manually.

Re: Question regarding Search Jobs

misteryuku — Thu, 08 Mar 2012 07:12:18 GMT

I'm very new to Splunk and i just want to know.

Re: Question regarding Search Jobs

Masa — Fri, 09 Mar 2012 07:31:20 GMT

What is "search error" ?