topic Re: Why I have very old time in my job list? in Splunk Search

Why I have very old time in my job list?

jujis008 — Thu, 14 Jul 2016 08:22:26 GMT

Dear All Splunkers,
I've a very problem in my job list which is I got the oldest query, but actually there is not conditions in search body.

so my queries was hanged, there was nothing except I build a dashboard for some queries.

does any one have the same issue?

thank you all

Re: Why I have very old time in my job list?

jujis008 — Fri, 15 Jul 2016 08:25:34 GMT

is there any possible that's a bug in Splunk? anyone got the same issue?

Re: Why I have very old time in my job list?

sheamus69 — Fri, 15 Jul 2016 11:33:55 GMT

Have you checked your clock settings on your Splunk boxes?

Also, that happens if you inspect those jobs?

Re: Why I have very old time in my job list?

jujis008 — Mon, 18 Jul 2016 06:22:56 GMT

yes, clock setting is good, even I want to set time as 1/1/70 there will pop up errors.
no, not to inspect jobs. but if i click inspect job, there will a 500 internal error page.
error details as following:
500 Internal Server Error

Return to Splunk home page

View more information about your request (request ID = 578c7309667f4ac88bcc50) in Search

This page was linked to from https://cloudsearch-dc13.cld.XXXXXand.com/en-US/app/search/job_management.

You are logged into search-dc13.cld.XXXXXand.com as i324291, which is connected to splunkd @255606 at https://127.0.0.1:8089 on Mon Jul 18 06:11:21 2016.

however, i find some clues on the url.
app/search/test_clone?form.fieldtimeperf.earliest=-4h%40m&
form.fieldtimeperf.latest=now&
form.fieldtimeperf1.earliest=-24h%40h&
form.fieldtimeperf1.latest=now&
form.fieldtimeperf2.earliest=-24h%40h&
form.fieldtimeperf2.latest=now&
form.fieldtimeusercpu.earliest=-4h%40m&
form.fieldtimeusercpu.latest=now&
form.fieldtimesyscpu.earliest=-4h%40m&
form.fieldtimesyscpu.latest=now&
form.fieldtimettcpu.earliest=-4h%40m&
form.fieldtimettcpu.latest=now&
earliest=0&
latest=
the last parameters will be added automatically, even if you removed it manually, but no sure if cause by the parameter

Re: Why I have very old time in my job list?

snoobzilla — Tue, 29 Sep 2020 10:17:18 GMT

I suspect these are scheduled jobs that have not started yet (and should have) so if your instance is running behind on scheduled jobs these start to stack up... which of course is exactly when you are most likely to be looking at activity, when things are slow. Suspicion is based on feedback from case we are working through with Splunk.

Take a look at your skipped jobs ratio at the same time you are seeing these in DMC app/splunk_management_console/scheduler_activity_deployment

Re: Why I have very old time in my job list?

snoobzilla — Thu, 21 Jul 2016 11:09:11 GMT

Yes https://answers.splunk.com/answers/321611/why-are-jobs-showing-as-dispatched-at-123169-and-k.html

Re: Why I have very old time in my job list?

jujis008 — Thu, 28 Jul 2016 10:58:44 GMT

Exactly, I noticed this is because there are some queries not start yet and showing the start time as 0 this morning. thank you very much!