Splunk Search

How do we know if user stopped or pause the search while running the splunk query

harishsplunk7
Explorer

The query below is showing some details about ad-hoc searches. The “info” field in index=_audit has 4 possible values: completed, granted, canceled, failed.

I assume ‘granted’ means that the user was granted access to run the query, i.e., has the permission to access the indexes, run this type of query etc. I assume ‘canceled’ means that the query was cancelled. How do we know if it was cancelled by the user (user pressed the Stop button or Pause), or if it timed out by the system because it took too long to run ?

I found field fully_completed_search, but it is always true.
What would be some of the reasons to get a ‘failed’ status ?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There is no "query below" in the OP.

There should be a 'reason' field in the events that explains the info field.

---
If this reply helps you, Karma would be appreciated.
0 Karma

harishsplunk7
Explorer

There is no reason field in audit log to explaing the info, even i am not finding it anywhere splunk documentation. 

Is there any other way to get the search query stopped by user using splunk queries? 

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...