Reporting

What happened to logging of my scheduled searches (by name) in version 4.0?

the_wolverine
Champion
INFO  SavedSplunker - Found 2 scheduled saved searches
INFO  SavedSplunker - About to run saved search: 'admin;search;badger', next run: Thu Apr 29 12:43:00 2010, trigger_actions=1
INFO  SavedSplunker - setting ttl=120 for savedsearch_ident="admin;search;badger"
INFO  SavedSplunker - dispatched search for savedsearch_id="admin;search;badger"
INFO  SavedSplunker - Saved search 'admin;search;badger' next run time set to: "Thu Apr 29 12:44:00 2010"
INFO  SavedSplunker - changing ttl of sid=scheduler_admin_search_badger_at_1272570180_1230566965, new_ttl=86400
INFO  SavedSplunker - AlertNotifier ran notifications=1, actions=1, managedSearchCount=0

It used to be that I could see my scheduled search runs in splunkd.log like above. This was very useful for debugging. What happened to them?

0 Karma
1 Solution

the_wolverine
Champion

SavedSplunker errors were converted to WARN in later versions of 4.0. You can re-enable logging at the INFO level by adding the following to your etc/log.cfg under [splunkd]:

[splunkd]
category.SavedSplunker=INFO

If you've got lots of scheduled searches this will result in a noisy splunkd.log.

In 4.1 we change the default logging to INFO and give it its own logfile: scheduler.log.

View solution in original post

0 Karma

the_wolverine
Champion

SavedSplunker errors were converted to WARN in later versions of 4.0. You can re-enable logging at the INFO level by adding the following to your etc/log.cfg under [splunkd]:

[splunkd]
category.SavedSplunker=INFO

If you've got lots of scheduled searches this will result in a noisy splunkd.log.

In 4.1 we change the default logging to INFO and give it its own logfile: scheduler.log.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...