Monitoring Splunk

How to detect finalization of subsearches?

huszti21
Explorer

Hi all,

regarding a complete monitoring for our customers we want to detect if a subsearch is finalized.
If this happens the search results of the corresponding main search could be incomplete.
Especially for scheduled searches, where no user gets a feedback, this would be helpful.

Is there any log channel, where this is logged?
I tried starting splunk in debug-mode but found nothing.

The only place are the search-logs, but indexing every search-log seems a bit oversized.

Any one out there who could provide a hint?

Thanks!

0 Karma
1 Solution

gjanders
SplunkTrust
SplunkTrust

SearchHeadLevel - Users with auto-finalized searches

Is the savedsearch name I use in Alerts for Splunk Admins, refer to https://raw.githubusercontent.com/gjanders/SplunkAdmins/master/default/savedsearches.conf or the full app https://splunkbase.splunk.com/app/3796/

You will need to enable splunk search messages, limits.conf setting log_search_messages=true

View solution in original post

gjanders
SplunkTrust
SplunkTrust

SearchHeadLevel - Users with auto-finalized searches

Is the savedsearch name I use in Alerts for Splunk Admins, refer to https://raw.githubusercontent.com/gjanders/SplunkAdmins/master/default/savedsearches.conf or the full app https://splunkbase.splunk.com/app/3796/

You will need to enable splunk search messages, limits.conf setting log_search_messages=true

PickleRick
Ultra Champion

Correct me if I'm wrong but I don't think there's reliable way to detect such things. That's why using subsearches in situations when they can "runaway" to such big result sets is highly discouraged and such searches should be reconsidered and possibly redesigned to use other means of getting same results.

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...