https://community.splunk.com/t5/Splunk-Search/Unable-to-save-search-history/m-p/113884#M30066 <P>Hi there, we're seeing messages like the one below in splunkd.log on our search head (hostname TTNET-CH-SPSCH-1). We have about 50 users in our Splunk environment that authenticate via LDAP, and we seem to get a message like the one below every few minutes or so. This seems to happen for pretty much every user we have and across all kinds of searches.</P> <P>Any idea what's going on here? The impact seems fairly minimal, eg. we just won't have a complete search history stored in Splunk? Still, any information you could provide would be useful. I have turned up debug logging on the DispatchSearch component but nothing is jumping out at me. </P> <P>Let me know if you need anything else from me. An example snippet is below. Thanks for the help!</P> <PRE><CODE>10-24-2013 06:56:13.661 -0500 ERROR SearchResults - Failed to remove "/opt/splunk/etc/users/&lt;some_user&gt;/search/history/TTNET-CH-SPSCH-1.ttnet.local.csv.tmp": No such file or directory 10-24-2013 06:56:13.663 -0500 WARN DispatchSearch - Unable to save search history for user=&lt;some_user&gt;, app=search, sid=1382615771.5102, search='&lt;some_search_here&gt;' </CODE></PRE> Thu, 24 Oct 2013 16:46:19 GMT jerdmann 2013-10-24T16:46:19Z https://community.splunk.com/t5/Splunk-Search/Unable-to-save-search-history/m-p/113884#M30066 <P>Hi there, we're seeing messages like the one below in splunkd.log on our search head (hostname TTNET-CH-SPSCH-1). We have about 50 users in our Splunk environment that authenticate via LDAP, and we seem to get a message like the one below every few minutes or so. This seems to happen for pretty much every user we have and across all kinds of searches.</P> <P>Any idea what's going on here? The impact seems fairly minimal, eg. we just won't have a complete search history stored in Splunk? Still, any information you could provide would be useful. I have turned up debug logging on the DispatchSearch component but nothing is jumping out at me. </P> <P>Let me know if you need anything else from me. An example snippet is below. Thanks for the help!</P> <PRE><CODE>10-24-2013 06:56:13.661 -0500 ERROR SearchResults - Failed to remove "/opt/splunk/etc/users/&lt;some_user&gt;/search/history/TTNET-CH-SPSCH-1.ttnet.local.csv.tmp": No such file or directory 10-24-2013 06:56:13.663 -0500 WARN DispatchSearch - Unable to save search history for user=&lt;some_user&gt;, app=search, sid=1382615771.5102, search='&lt;some_search_here&gt;' </CODE></PRE> Thu, 24 Oct 2013 16:46:19 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-save-search-history/m-p/113884#M30066 jerdmann 2013-10-24T16:46:19Z https://community.splunk.com/t5/Splunk-Search/Unable-to-save-search-history/m-p/113885#M30067 <P>This is apparently a known issue in Splunk 5.x. It's a harmless message according to Splunk support. Good enough for now...</P> Tue, 07 Jan 2014 19:19:15 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-save-search-history/m-p/113885#M30067 jerdmann 2014-01-07T19:19:15Z