When my search runs for more than 10 min, 'job-id' expires since the default TTL value is 600 (10 min), so I get "unknown sid" in the search view.
I tried to recover the job by the option "Send job to background" - which should ideally extend the particular job-id's TTL value under the metadata.csv in dispatch folder.
However, since the folder itself gets removed, there is no possibility to reset the value, whereby there is no action in the search head when I click "Send job to background".
Is this a known issue ?
When you click on "Send Job to Background, you should get a popup that asks you if you would like to be notified by email when the job is complete. Are you getting this dialog?
Yes , i am getting this dialog. I choose the option "Email when complete" and provided my mail-id.
But no response after i submit.
When i close the dialog , it takes me back to the "search" window . No traces found for that particular search_id
did you delete dispatch folder? or cleared it?
if dispatch folder fills , then search takes time.
no I do have enough free space , also i haven't deleted anything in dispatch folder.
I hope so , since the default TTL is 600 seconds , splunk automatically clears the "search-id" folder , and shows me "Unknown Sid" , so eventhough I send job to background , there is no traces of my job , so i get no response.
TO resolve this , eventhough the TTL is 600 , that search-id folder in dispatch directory should exist for more time, or else "Send job to background" should be disabled in splunkweb ??!
does this make sense ?
Opening a support case won't actually help, since it is very easy to determine the cause of this problem. I instead would open a support case to report the UI bug that the model displayed without checking the state of the job.
Additionally, don't wait 10 minutes in the UI. Send the job to background immediately if you want it to continue past 10 minutes.
Conversely, try some search optimizations and enhancements to see if you can speed up the search it self.