Monitoring Splunk

What does it mean searchparsetmp in the StreamedSearch in _internal events?


Splunk Enterprise OnPrem 9.0.1.
We are troubleshooting an issue where some alerts are beign triggered incorrectly, and found a correlation between this odd triggers and _internal events with sourcetype = splunkd_remote_searches.

The events are described as:
01-18-2023 14:03:00.178 -0300 INFO StreamedSearch - Streamed search connection closed: search_id=remote_<node>_subsearch_searchparsetmp_ ...

What does searchparsetmp mean in the context of the subsearch?
Also whats is the difference with remote_<node>_subsearch_scheduler_ ... also describing similar events on _internal?

Labels (2)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti &#x1f389; —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...