Splunk Search

splunk Waiting for queued job to start getting error for a particular user

joe06031990
Communicator

Hi,

I have splunk Waiting for queued job to start getting error for a particular user however no jobs are queued for that user in the Job monitor, the role can run 50 concurrent searches and is only affected this user.

Also no jobs are in queued,Parsing,Finalising or Finalised. 

Any advice?

 

Thanks

Labels (1)
Tags (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

How about your environment? Which kind it is?

You can always look those internal indexes on your nodes logs like .../var/log/splunk directory.

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

What you will get with query

index=_audit user=<your user>

Are there any hints why he/she cannot run those queries?

What is a topology of your environment (distributed, single node etc)?

r. Ismo 

joe06031990
Communicator

Hi,

The user is me and I get the message queued and I have the admin role. 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

How about your environment? Which kind it is?

You can always look those internal indexes on your nodes logs like .../var/log/splunk directory.

Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...