Splunk Enterprise

mcatalog causing ERROR SearchPhaseGenerator - Fallback to two phase search failed:Term based search is not supported

lim2
Communicator

Hi,

Getting following errors from failed |mcatalog search against metrics index using a power user role. The |mcatalog search runs ok with admin role. The search was running ok in Splunk 7.3.3 but getting error in Splunk 8.0.2. Power user role has the metric_alerts and list_metrics_catalog capabilities

Search: |mcatalog values(metric_name) where index=os_metrics causing

ERROR SearchPhaseGenerator - Fallback to two phase search failed:Term based search is not supported

ERROR SearchOrchestrator - Term based search is not supported
ERROR SearchStatusEnforcer - sid:1597278941.14635_FE8E9C88-7BFB-466C-BA64-C8544C690C88 Term based search is not supported
ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Term based search is not supported

  Any suggestions on the cause of the "Term based search is not supported" and solution would be welcome. Thanks.

Labels (1)
0 Karma

cstump_splunk
Splunk Employee
Splunk Employee

Double-check the searchFilter associated with role that is producing the error. The key::value syntax can cause problems with metrics data.

For example:

 

[role_test]
srchFilter= index::*

 

Any time a user int the 'test' role runs one of these metrics searches, "index::*" will be appended to (or at least included in) the search. This is what the "Term based search is not supported" message is referring to. It is not expecting the key=value syntax. 

From Add and Edit Roles docs :

For search filters with metrics data, use the key=value to specify search restrictions to metrics fields. This is because the key::value syntax does not work for searches over metrics data. In this case, you can safely disregard syntax warnings about the = operator that the search filter dialog box presents.


 

haraksin
Path Finder

I am having this same problem; not sure what's going on...

 

0 Karma

jlstanley
Path Finder

has anyone figured out a way to use srchFiltering with "::" indexed fields in it but still allow user to search metrics indexes?  the docs say metrics indexes are supposed to ignore srchFilters but if a user is part any other roles with :: in the srchFilter they can no longer search metrics indexes.

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...