Splunk Search

The search job terminated unexpectedly.

priyanka_231019
Explorer

Splunk internal logs: INFO StreamedSearch - Streamed search connection terminated

 

Splunk search:

index=oswinsec source="*WinEventLog:Security" action=success
| stats count min(_time) as earliest max(_time) as latest by user
| multireport
[| stats values(*) as * by user
| lookup account_status_tracker user OUTPUT count as prior_count earliest as prior_earliest latest as prior_latest
| where prior_latest < relative_time(now(), "-30d")
| eval explanation="The last login from this user was " . (round( (earliest-prior_latest) / 3600/24, 2) ) . " days ago."
| convert ctime(earliest) ctime(latest) ctime(prior_earliest) ctime(prior_latest) ]
[| inputlookup append=t account_status_tracker
| stats min(earliest) as earliest max(latest) as latest sum(count) as count by user
| outputlookup account_status_tracker ]
| stats count

 

The search was working fine until today.

Kindly suggest.

Labels (1)
0 Karma

priyanka_231019
Explorer

I did some digging at my end. Apparently, some issue with the search query itself. This query was working fine. The multireport is somehow now causing search to terminate. If I run the query in two parts as below, it is fine.

index=oswinsec source="*WinEventLog:Security" action=success
| stats count min(_time) as earliest max(_time) as latest by user
| stats values(*) as * by user
| lookup account_status_tracker user OUTPUT count as prior_count earliest as prior_earliest latest as prior_latest
| where prior_latest < relative_time(now(), "-30d")
| eval explanation="The last login from this user was " . (round( (earliest-prior_latest) / 3600/24, 2) ) . " days ago."
| convert ctime(earliest) ctime(latest) ctime(prior_earliest) ctime(prior_latest) 

 

 

index=oswinsec source="*WinEventLog:Security" action=success
| inputlookup append=t account_status_tracker
| stats min(earliest) as earliest max(latest) as latest sum(count) as count by user
| outputlookup account_status_tracker 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It's possible the search was cancelled because your role used up all of its allowed resources.  Check the search log.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...