Monitoring Splunk

[splunkd.log error] DispatchSearch - Unable to saved search history for user=admin

Path Finder

I got this warning in splunkd.log. What's the problem and how may I solve it?

11-29-2012 11:43:03.561 +0100 WARN  DispatchSearch - Unable to saved search history for user=admin, app=search, sid=admin__admin__search__RMD5dd6855e83ddc75b6_1354185781.59762, search='search online_aname="*IIS_Slow_Request_Percent*" OR online_aname="IIS_Status_Code*" OR online_aname="VOD_player_errors*" OR online_aname="susoapp_all_response_4xx" OR online_aname="susoapp_all_response_5xx" OR online_aname = "ckm_qi.error*" source="/var/log/online-alerts_splunk2.log"  | dedup online_aname, online_ahostname | stats dc(online_aname) as errors |rangemap field=errors low=0-4 default=severe'

Splunk Employee
Splunk Employee

This error (usually!) comes from the way we store the search history on a per-user basis. We use a csv-storage component that does not handle the case of multiple updaters at the same time. When running many searches, it's possible to have overlapping updates to the per-user history csv file. The result is that the component that tries to help complete your searches with searchers that you have run recently in the drop-down box below the search bar will not have complete information. That is the only repercussion.

Thus this message is usually completely ignorable. It was made somewhat less noisy in 6.x some version. If you are on 5.x it is more noisy.

If you have other errors surrounding this message then there may be something worth investigating.

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!