Monitoring Splunk

[splunkd.log error] DispatchSearch - Unable to saved search history for user=admin

bckq
Path Finder

I got this warning in splunkd.log. What's the problem and how may I solve it?

11-29-2012 11:43:03.561 +0100 WARN  DispatchSearch - Unable to saved search history for user=admin, app=search, sid=admin__admin__search__RMD5dd6855e83ddc75b6_1354185781.59762, search='search online_aname="*IIS_Slow_Request_Percent*" OR online_aname="IIS_Status_Code*" OR online_aname="VOD_player_errors*" OR online_aname="susoapp_all_response_4xx" OR online_aname="susoapp_all_response_5xx" OR online_aname = "ckm_qi.error*" source="/var/log/online-alerts_splunk2.log"  | dedup online_aname, online_ahostname | stats dc(online_aname) as errors |rangemap field=errors low=0-4 default=severe'

jrodman
Splunk Employee
Splunk Employee

This error (usually!) comes from the way we store the search history on a per-user basis. We use a csv-storage component that does not handle the case of multiple updaters at the same time. When running many searches, it's possible to have overlapping updates to the per-user history csv file. The result is that the component that tries to help complete your searches with searchers that you have run recently in the drop-down box below the search bar will not have complete information. That is the only repercussion.

Thus this message is usually completely ignorable. It was made somewhat less noisy in 6.x some version. If you are on 5.x it is more noisy.

If you have other errors surrounding this message then there may be something worth investigating.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...