Getting Data In

Which index does search.log data populates in, in splunk?

Mohsin123
Path Finder

Hi ,

Does anyone know which index does search.log data populates in?
I find search.log during a job inspect, mostly its the source /var/run/ dispatch.
How to fetch that in Splunk UI?

Also another question,

What does the line below represent? Does it report the size in MB?

INFO  DispatchThread - Disk quota = 31457280000

Cheers !

Tags (2)
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Search logs are not indexed so you won't find them in the UI, except via the job inspector.

The disk quota is the amount of storage allowed for the search. I believe it is in bytes.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

nickhills
Ultra Champion

search.log is not indexed, and it expires (gets deleted) when the job expires.

Each user (or role) has a maximum disk quota fromwhich search jobs consume space (until they expire).
Run too many large searches, and the quota fills up, preventing more searches, until some of the old ones have been cleared out (by default 10 mins).
I expect that value to be in bytes, rather than MB.

If my comment helps, please give it a thumbs up!

iandrews_splunk
Splunk Employee
Splunk Employee

are you just trying to get the search string, itself?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Search logs are not indexed so you won't find them in the UI, except via the job inspector.

The disk quota is the amount of storage allowed for the search. I believe it is in bytes.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...