Monitoring Splunk

[splunkd.log error] DispatchSearch - Unable to saved search history for user=admin

Path Finder

I got this warning in splunkd.log. What's the problem and how may I solve it?

11-29-2012 11:43:03.561 +0100 WARN  DispatchSearch - Unable to saved search history for user=admin, app=search, sid=admin__admin__search__RMD5dd6855e83ddc75b6_1354185781.59762, search='search online_aname="*IIS_Slow_Request_Percent*" OR online_aname="IIS_Status_Code*" OR online_aname="VOD_player_errors*" OR online_aname="susoapp_all_response_4xx" OR online_aname="susoapp_all_response_5xx" OR online_aname = "ckm_qi.error*" source="/var/log/online-alerts_splunk2.log"  | dedup online_aname, online_ahostname | stats dc(online_aname) as errors |rangemap field=errors low=0-4 default=severe'

Splunk Employee
Splunk Employee

This error (usually!) comes from the way we store the search history on a per-user basis. We use a csv-storage component that does not handle the case of multiple updaters at the same time. When running many searches, it's possible to have overlapping updates to the per-user history csv file. The result is that the component that tries to help complete your searches with searchers that you have run recently in the drop-down box below the search bar will not have complete information. That is the only repercussion.

Thus this message is usually completely ignorable. It was made somewhat less noisy in 6.x some version. If you are on 5.x it is more noisy.

If you have other errors surrounding this message then there may be something worth investigating.

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...