Installation

Compare puncts (logs) generated before and after upgrade: set intersect subsearches timing out

woodcock
Esteemed Legend

We had an upgrade of a system and it is definitely generating different logs. I was trying to use the following search to tell me what logs (puncts) were generated before the upgrade (late at night on 3/21) that were not generated after the upgrade. I decided to go 1 week on either side but it keeps timing out so I dropped it to 1 day and the same thing. Each subsearch works just fine as an individual (non-setted) search and gives punct data so I don't get it. This should work on any deployment so I am sure somebody out there will see what is wrong and help me out; give it a try:

| set intersect [search index=xxx earliest=3/14/2012:0:0:0 latest=3/22/2012:0:0:0 | stats count by punct | fields punct | fields - _*] [search index=xxx earliest=3/22/2012:0:0:0 latest=3/29/2012:0:0:0 | stats count by punct | fields punct | fields - _*]

    Timed out waiting for status to become available on job=1334683581.8709746
    Timed out waiting for status to become available on job=1334683408.8709536
Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

I think the problem really is non-backgrounded timeouts so I sent it to the background to see if I can get it to run to completion. I also slightly modified the search to what I believe will be more efficient:

|set intersect [ search index=xxx earliest=3/14/2012:0:0:0 latest=3/22/2012:0:0:0 | stats values(punct) as puncts | mvexpand puncts ] [ search index=xxx earliest=3/22/2012:0:0:0 latest=3/29/2012:0:0:0 | stats values(punct) as puncts | mvexpand puncts ]

View solution in original post

woodcock
Esteemed Legend

I think the problem really is non-backgrounded timeouts so I sent it to the background to see if I can get it to run to completion. I also slightly modified the search to what I believe will be more efficient:

|set intersect [ search index=xxx earliest=3/14/2012:0:0:0 latest=3/22/2012:0:0:0 | stats values(punct) as puncts | mvexpand puncts ] [ search index=xxx earliest=3/22/2012:0:0:0 latest=3/29/2012:0:0:0 | stats values(punct) as puncts | mvexpand puncts ]
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...