Monitoring Splunk

[splunkd.log error] DispatchSearch - Unable to saved search history for user=admin

bckq
Path Finder

I got this warning in splunkd.log. What's the problem and how may I solve it?

11-29-2012 11:43:03.561 +0100 WARN  DispatchSearch - Unable to saved search history for user=admin, app=search, sid=admin__admin__search__RMD5dd6855e83ddc75b6_1354185781.59762, search='search online_aname="*IIS_Slow_Request_Percent*" OR online_aname="IIS_Status_Code*" OR online_aname="VOD_player_errors*" OR online_aname="susoapp_all_response_4xx" OR online_aname="susoapp_all_response_5xx" OR online_aname = "ckm_qi.error*" source="/var/log/online-alerts_splunk2.log"  | dedup online_aname, online_ahostname | stats dc(online_aname) as errors |rangemap field=errors low=0-4 default=severe'

jrodman
Splunk Employee
Splunk Employee

This error (usually!) comes from the way we store the search history on a per-user basis. We use a csv-storage component that does not handle the case of multiple updaters at the same time. When running many searches, it's possible to have overlapping updates to the per-user history csv file. The result is that the component that tries to help complete your searches with searchers that you have run recently in the drop-down box below the search bar will not have complete information. That is the only repercussion.

Thus this message is usually completely ignorable. It was made somewhat less noisy in 6.x some version. If you are on 5.x it is more noisy.

If you have other errors surrounding this message then there may be something worth investigating.

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!