[splunkd.log error] DispatchSearch - Unable to saved search history for user=admin

[bckq]

I got this warning in splunkd.log. What's the problem and how may I solve it?

11-29-2012 11:43:03.561 +0100 WARN  DispatchSearch - Unable to saved search history for user=admin, app=search, sid=admin__admin__search__RMD5dd6855e83ddc75b6_1354185781.59762, search='search online_aname="*IIS_Slow_Request_Percent*" OR online_aname="IIS_Status_Code*" OR online_aname="VOD_player_errors*" OR online_aname="susoapp_all_response_4xx" OR online_aname="susoapp_all_response_5xx" OR online_aname = "ckm_qi.error*" source="/var/log/online-alerts_splunk2.log"  | dedup online_aname, online_ahostname | stats dc(online_aname) as errors |rangemap field=errors low=0-4 default=severe'

[jrodman]

This error (usually!) comes from the way we store the search history on a per-user basis. We use a csv-storage component that does not handle the case of multiple updaters at the same time. When running many searches, it's possible to have overlapping updates to the per-user history csv file. The result is that the component that tries to help complete your searches with searchers that you have run recently in the drop-down box below the search bar will not have complete information. That is the only repercussion.

Thus this message is usually completely ignorable. It was made somewhat less noisy in 6.x some version. If you are on 5.x it is more noisy.

If you have other errors surrounding this message then there may be something worth investigating.