Installation

Compare puncts (logs) generated before and after upgrade: set intersect subsearches timing out

woodcock
Esteemed Legend

We had an upgrade of a system and it is definitely generating different logs. I was trying to use the following search to tell me what logs (puncts) were generated before the upgrade (late at night on 3/21) that were not generated after the upgrade. I decided to go 1 week on either side but it keeps timing out so I dropped it to 1 day and the same thing. Each subsearch works just fine as an individual (non-setted) search and gives punct data so I don't get it. This should work on any deployment so I am sure somebody out there will see what is wrong and help me out; give it a try:

| set intersect [search index=xxx earliest=3/14/2012:0:0:0 latest=3/22/2012:0:0:0 | stats count by punct | fields punct | fields - _*] [search index=xxx earliest=3/22/2012:0:0:0 latest=3/29/2012:0:0:0 | stats count by punct | fields punct | fields - _*]

    Timed out waiting for status to become available on job=1334683581.8709746
    Timed out waiting for status to become available on job=1334683408.8709536
Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

I think the problem really is non-backgrounded timeouts so I sent it to the background to see if I can get it to run to completion. I also slightly modified the search to what I believe will be more efficient:

|set intersect [ search index=xxx earliest=3/14/2012:0:0:0 latest=3/22/2012:0:0:0 | stats values(punct) as puncts | mvexpand puncts ] [ search index=xxx earliest=3/22/2012:0:0:0 latest=3/29/2012:0:0:0 | stats values(punct) as puncts | mvexpand puncts ]

View solution in original post

woodcock
Esteemed Legend

I think the problem really is non-backgrounded timeouts so I sent it to the background to see if I can get it to run to completion. I also slightly modified the search to what I believe will be more efficient:

|set intersect [ search index=xxx earliest=3/14/2012:0:0:0 latest=3/22/2012:0:0:0 | stats values(punct) as puncts | mvexpand puncts ] [ search index=xxx earliest=3/22/2012:0:0:0 latest=3/29/2012:0:0:0 | stats values(punct) as puncts | mvexpand puncts ]
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...