Splunk Search

What does the status of "info=granted" mean in my search?

rahulrawlani
Explorer

I am trying to find out all the searches made by users in Splunk. I am running the below search

index=_audit action=search user!="splunk-system-user" search_id=* | table search_id savedsearch_name search user info total_run_time is_realtime

I see 4 status options for the info field...1. completed. 2. cancelled. 3. granted 4. failed.

I see that many of the searches (regardless whether they are savedsearches or ad-hoc) are assigned info as "granted". I do not get any idea what granted means...Can anyone please help me here...

0 Karma

net1993
Path Finder

@yannK
Where can be found some docs about all possible values of that field with the meaning of the values?

0 Karma

amartin6
Path Finder

We were seeing more "completed" searches than "granted" searches, we had to exclude subsearches:
index=_audit action=search search=* search_id!="'subsearch*" info=granted

0 Karma

yannK
Splunk Employee
Splunk Employee

"granted" means that the scheduler or the user was allowed to run the search.
The search will run when possible.
Then once the job is done, you will see the field value "completed".

This is because a job can be delayed or queued (depending of the prioritization, or execution windows or concurrent search limits).

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!