Monitoring Splunk

How to detect finalization of subsearches?

huszti21
Explorer

Hi all,

regarding a complete monitoring for our customers we want to detect if a subsearch is finalized.
If this happens the search results of the corresponding main search could be incomplete.
Especially for scheduled searches, where no user gets a feedback, this would be helpful.

Is there any log channel, where this is logged?
I tried starting splunk in debug-mode but found nothing.

The only place are the search-logs, but indexing every search-log seems a bit oversized.

Any one out there who could provide a hint?

Thanks!

0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

SearchHeadLevel - Users with auto-finalized searches

Is the savedsearch name I use in Alerts for Splunk Admins, refer to https://raw.githubusercontent.com/gjanders/SplunkAdmins/master/default/savedsearches.conf or the full app https://splunkbase.splunk.com/app/3796/

You will need to enable splunk search messages, limits.conf setting log_search_messages=true

View solution in original post

gjanders
SplunkTrust
SplunkTrust

SearchHeadLevel - Users with auto-finalized searches

Is the savedsearch name I use in Alerts for Splunk Admins, refer to https://raw.githubusercontent.com/gjanders/SplunkAdmins/master/default/savedsearches.conf or the full app https://splunkbase.splunk.com/app/3796/

You will need to enable splunk search messages, limits.conf setting log_search_messages=true

PickleRick
Ultra Champion

Correct me if I'm wrong but I don't think there's reliable way to detect such things. That's why using subsearches in situations when they can "runaway" to such big result sets is highly discouraged and such searches should be reconsidered and possibly redesigned to use other means of getting same results.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...