Monitoring Splunk

How to detect finalization of subsearches?

huszti21
Explorer

Hi all,

regarding a complete monitoring for our customers we want to detect if a subsearch is finalized.
If this happens the search results of the corresponding main search could be incomplete.
Especially for scheduled searches, where no user gets a feedback, this would be helpful.

Is there any log channel, where this is logged?
I tried starting splunk in debug-mode but found nothing.

The only place are the search-logs, but indexing every search-log seems a bit oversized.

Any one out there who could provide a hint?

Thanks!

0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

SearchHeadLevel - Users with auto-finalized searches

Is the savedsearch name I use in Alerts for Splunk Admins, refer to https://raw.githubusercontent.com/gjanders/SplunkAdmins/master/default/savedsearches.conf or the full app https://splunkbase.splunk.com/app/3796/

You will need to enable splunk search messages, limits.conf setting log_search_messages=true

View solution in original post

gjanders
SplunkTrust
SplunkTrust

SearchHeadLevel - Users with auto-finalized searches

Is the savedsearch name I use in Alerts for Splunk Admins, refer to https://raw.githubusercontent.com/gjanders/SplunkAdmins/master/default/savedsearches.conf or the full app https://splunkbase.splunk.com/app/3796/

You will need to enable splunk search messages, limits.conf setting log_search_messages=true

PickleRick
Ultra Champion

Correct me if I'm wrong but I don't think there's reliable way to detect such things. That's why using subsearches in situations when they can "runaway" to such big result sets is highly discouraged and such searches should be reconsidered and possibly redesigned to use other means of getting same results.

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...