Splunk Search

How do we know if user stopped or pause the search while running the splunk query

harishsplunk7
Explorer

The query below is showing some details about ad-hoc searches. The “info” field in index=_audit has 4 possible values: completed, granted, canceled, failed.

I assume ‘granted’ means that the user was granted access to run the query, i.e., has the permission to access the indexes, run this type of query etc. I assume ‘canceled’ means that the query was cancelled. How do we know if it was cancelled by the user (user pressed the Stop button or Pause), or if it timed out by the system because it took too long to run ?

I found field fully_completed_search, but it is always true.
What would be some of the reasons to get a ‘failed’ status ?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is no "query below" in the OP.

There should be a 'reason' field in the events that explains the info field.

---
If this reply helps you, Karma would be appreciated.
0 Karma

harishsplunk7
Explorer

There is no reason field in audit log to explaing the info, even i am not finding it anywhere splunk documentation. 

Is there any other way to get the search query stopped by user using splunk queries? 

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...