Splunk Enterprise

Debug message SHCSlave getSearchConcurrency useTotalSearchConcurrency=0

Solitus31
Explorer

Hello,
I have a debug log on only one SH of my SHC.

componentSHCSlave
event_messagegetSearchConcurrency useTotalSearchConcurrency=0

 

i've crosschecked SH configuration, SHC configuration ands scheduled searches on this SH but found nothing helping me to understand this behavior.

I didn't find this message on other SH so i try to investigate local configuration but still found nothing

if someone have an idea

Labels (2)
0 Karma
1 Solution

livehybrid
SplunkTrust
SplunkTrust

Hi @Solitus31 

Do you have category.SHCSlave=DEBUG anywhere in a .cfg (e.g. log.cfg) in $SPLUNK_HOME/etc ?

Do you have any components/categories set to DEBUG in $SPLUNK_HOME/etc/log*.cfg files which are between the SHC members?

If possible can you please post the entire log event.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

View solution in original post

0 Karma

Solitus31
Explorer

Hello @livehybrid ,

thanks for your reply.

I found a log-local.cfg only on this SH with some DEGUB activated.
After deleted this files, no more ERROR event_message for getSearchConcurrency.

Many thanks for your help
Regards

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @Solitus31 

Do you have category.SHCSlave=DEBUG anywhere in a .cfg (e.g. log.cfg) in $SPLUNK_HOME/etc ?

Do you have any components/categories set to DEBUG in $SPLUNK_HOME/etc/log*.cfg files which are between the SHC members?

If possible can you please post the entire log event.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...