Splunk Search
Highlighted

What is causing my Activity Jobs pages to be filled with subsearch entries and how do I stop this?

Motivator

Currently, I have 12.5 pages filled completely with searches which look exactly like:

| subsearch

Many of those entries appear to have the exact same Size and their run time are all 1s. Also, clicking on any of the subsearch search links brings a search page with the same lookup table displayed.

What is causing all of these ambiguous searches? How can I stop them from flooding my Job pages?

Highlighted

Re: What is causing my Activity Jobs pages to be filled with subsearch entries and how do I stop this?

Splunk Employee
Splunk Employee

I'm guessing you have a realtime search that includes a subsearch as part of the RT search.

Highlighted

Re: What is causing my Activity Jobs pages to be filled with subsearch entries and how do I stop this?

Motivator

I found and dealt with the rt searches. The number of subsearch entries greatly reduced (down to 2 entries on the first page), but I am still interested in why these entries exist? What useful value can these entries provide to me when I am looking through my search history? How can I determine whether the rt searches were the cause or if the reduction in subsearch entries is just a coincidence?

0 Karma