topic Re: What does the status of "info=granted" mean in my search? in Splunk Search

What does the status of "info=granted" mean in my search?

rahulrawlani — Thu, 29 Sep 2016 13:53:05 GMT

I am trying to find out all the searches made by users in Splunk. I am running the below search

index=_audit action=search user!="splunk-system-user" search_id=* | table search_id savedsearch_name search user info total_run_time is_realtime

I see 4 status options for the info field...1. completed. 2. cancelled. 3. granted 4. failed.

I see that many of the searches (regardless whether they are savedsearches or ad-hoc) are assigned info as "granted". I do not get any idea what granted means...Can anyone please help me here...

Re: What does the status of "info=granted" mean in my search?

yannK — Thu, 29 Sep 2016 15:30:19 GMT

"granted" means that the scheduler or the user was allowed to run the search.
The search will run when possible.
Then once the job is done, you will see the field value "completed".

This is because a job can be delayed or queued (depending of the prioritization, or execution windows or concurrent search limits).

Re: What does the status of "info=granted" mean in my search?

net1993 — Fri, 30 Nov 2018 13:28:16 GMT

@yannK
Where can be found some docs about all possible values of that field with the meaning of the values?

Re: What does the status of "info=granted" mean in my search?

amartin6 — Wed, 30 Sep 2020 05:15:33 GMT

We were seeing more "completed" searches than "granted" searches, we had to exclude subsearches:
index=_audit action=search search=* search_id!="'subsearch*" info=granted