Splunk Search

Unable to save search history?

jerdmann
Path Finder

Hi there, we're seeing messages like the one below in splunkd.log on our search head (hostname TTNET-CH-SPSCH-1). We have about 50 users in our Splunk environment that authenticate via LDAP, and we seem to get a message like the one below every few minutes or so. This seems to happen for pretty much every user we have and across all kinds of searches.

Any idea what's going on here? The impact seems fairly minimal, eg. we just won't have a complete search history stored in Splunk? Still, any information you could provide would be useful. I have turned up debug logging on the DispatchSearch component but nothing is jumping out at me.

Let me know if you need anything else from me. An example snippet is below. Thanks for the help!

10-24-2013 06:56:13.661 -0500 ERROR SearchResults - Failed to remove "/opt/splunk/etc/users/<some_user>/search/history/TTNET-CH-SPSCH-1.ttnet.local.csv.tmp": No such file or directory
10-24-2013 06:56:13.663 -0500 WARN  DispatchSearch - Unable to save search history for user=<some_user>, app=search, sid=1382615771.5102, search='<some_search_here>'
0 Karma

jerdmann
Path Finder

This is apparently a known issue in Splunk 5.x. It's a harmless message according to Splunk support. Good enough for now...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...