I've been trying to resolve this since October and not getting traction. Turning to the community for help: I have seemingly contradictory information within the same log line makes me question- do we have an issue or not? On the one hand, i think i do because the history command shows the search is cancelled... and I trust this information. However, there are artifacts in the logs that make me question if the search is fully running (which appears to be true since "fully_completed_search=TRUE". .. so I am now confused if we have a problem or not.) Why do searches show fully_completed_search=TRUE and has_error_warn=FALSE when the info field (and history command) show "cancelled" and have a tag of "error" BOTTOM LINE QUESTION: Are my searches are running correctly and returning all results or not? Sample _audit log search activity that I found - not sure if this gives any usable insight Audit: [ timestamp=10-01-2021 16:31:40.338 , user=redacted_user , action=search , info=canceled , search_id= ' 1633105804.108286 ', has_error_warn=false , fully_completed_search=true , total_run_time=18.13 , event_count=0 , result_count=0 , available_count=0 , scan_count=133645 , drop_count=0 , exec_time=1633105804 , api_et=1633104900.000000000 , api_lt=1633105800.000000000 , api_index_et=N/A , api_index_lt=N/A , search_et=1633104900.000000000 , search_lt=1633105800.000000000 , is_realtime=0 , savedsearch_name= "", search_startup_time= " 1270 ", is_prjob=false , acceleration_id= " 98DCBC55-D36C-4671-93CD-1A950D796EC4_search_redacted_user_311d202b50b71a64 ", app= " search ", provenance= " N/A ", mode= " historical_batch ", workload_pool=standard_perf , is_proxied=false , searched_buckets=53 , eliminated_buckets=0 , considered_events=133645 , total_slices=331408 , decompressed_slices=11305 , duration.command.search.index=120 , invocations.command.search.index.bucketcache.hit=53 , duration.command.search.index.bucketcache.hit=0 , invocations.command.search.index.bucketcache.miss=0 , duration.command.search.index.bucketcache.miss=0 , invocations.command.search.index.bucketcache.error=0 , duration.command.search.rawdata=2533 , invocations.command.search.rawdata.bucketcache.hit=0 , duration.command.search.rawdata.bucketcache.hit=0 , invocations.command.search.rawdata.bucketcache.miss=0 , duration.command.search.rawdata.bucketcache.miss=0 , invocations.command.search.rawdata.bucketcache.error=0 , roles= ' redacted ', search= ' search index=oswinsec ( EventID=7036 OR EventID=50 OR EventID=56 OR EventID=1000 OR EventID=1001 ) | eval my_ts2 = _time * 1000 | eval indextime=_indextime | table my_ts2 , EventID | rename EventID as EventCode ']
... View more