Splunk Search

What is causing my Activity Jobs pages to be filled with subsearch entries and how do I stop this?

landen99
Motivator

Currently, I have 12.5 pages filled completely with searches which look exactly like:

| subsearch

Many of those entries appear to have the exact same Size and their run time are all 1s. Also, clicking on any of the subsearch search links brings a search page with the same lookup table displayed.

What is causing all of these ambiguous searches? How can I stop them from flooding my Job pages?

gkanapathy
Splunk Employee
Splunk Employee

I'm guessing you have a realtime search that includes a subsearch as part of the RT search.

landen99
Motivator

I found and dealt with the rt searches. The number of subsearch entries greatly reduced (down to 2 entries on the first page), but I am still interested in why these entries exist? What useful value can these entries provide to me when I am looking through my search history? How can I determine whether the rt searches were the cause or if the reduction in subsearch entries is just a coincidence?

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...