Background Search query

[Siya]

Hi All,

I have a Splunk search query executing the in the background(used Send to background option) while this is running my VPN got disconnected and after sometime I have reconnected to VPN and the query is still runing in the background. My question is does it gives me complete results or any incomplete results?

Thanks

[_JP]

You should have complete results based on your description and a couple of assumptions:

I am assuming that you are connecting to a remote Splunk instance (probably a Search Head (SH) - aka the Splunk website), and you are not running Splunk locally on your computer.  In that case, you would have complete results.  Your computer does not have to stay connected to a Splunk SH for a background search to complete properly.

[Siya]

Thanks for your response.

I have received this error message along with the results.

 Search results might be incomplete! This can occur if the peer unexpectedly closes or resets the connection during a planned restart. Try running your search again. 

[_JP]

That particular error is referring to a hiccup during the execution of the search with the search peers - aka the Splunk Indexers - that were involved in your query.  

Here is a diagram of a simple Splunk enterprise deployment - you were initiating your query on a Search Head, and that query is shared out to the Indexer(s) that make up your deployment.  It sounds like one of the Indexers had an issue:

To find more info on what your issue is, you can open your search results, and click on the Inspect Job option under the Job menu on the result page:

And then open the search.log from the Job Inspector page that pops up:

 

Within that log file that opens you can find more details on what happened during your search to trigger the warning message "Search results might be incomplete" that you saw.

If you have more info on any of the error/warning logs in that file we could help you figure out what could be causing your issue.