Reporting

Reporting on search errors

jamesdon
Path Finder

Hello,

We recently encountered an issue with a search that returned this error message:

[subsearch]: File '/opt/splunk/var/run/splunk/file_name.csv' could not be opened for reading.

While the fix was fairly simple, we would like to be notified when this type of issue starts in the future. I checked all of the index="_*" logs, and I do not see the error message. Is there a way for me to enable logging for this type of problem?

Thank you,

Jim

Tags (1)
0 Karma
1 Solution

MHibbin
Influencer

Have you tried looking at the S.o.S. App (Splunk on Splunk)... this is a diagnostics App for your Splunk installation there are a lot of useful searches/views here.

The S.o.S app can be found here... http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk

This is an App created by Splunk themselves, and is very helpful for multiple troubleshooting tools. It builds on the information from your installation (conf files, logs, etc.).

Regards,

MHibbin

View solution in original post

0 Karma

mayler
Path Finder

check web_service.log

0 Karma

MHibbin
Influencer

Have you tried looking at the S.o.S. App (Splunk on Splunk)... this is a diagnostics App for your Splunk installation there are a lot of useful searches/views here.

The S.o.S app can be found here... http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk

This is an App created by Splunk themselves, and is very helpful for multiple troubleshooting tools. It builds on the information from your installation (conf files, logs, etc.).

Regards,

MHibbin

0 Karma

MHibbin
Influencer

Jamesdon,

Good luck with this. I don't think you will always see the same error as in the logs... normally the logs would be for a "techie" and the web errors in a more human readable manner (for the general user)... As you probably already know 😛

Regards,

MHibbin

0 Karma

jamesdon
Path Finder

The SOS App uses logs in the _internal index, which I was searching before. However, when I looked again with a looser search, I found the cause - but not the error seen in the web browser. I'll play around with alerting based on log_level.

Thank you!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...