Hello, I'm using Splunk Java SDK. Something like the following: ... ... while (!myJob.isDone()) { try { Thread.sleep(500); } catch (InterruptedException e) { e.printStackTrace(); } } My search query takes a long time and hangs forever at myJob.isDone() But, when I inspect the job by going to Splunk Web's job inspector, I see the job is already done. Can you help if something wrong with what I'm doing? or is this a known issue with Splunk 6? ... View more

Hi, I found this community and the answers found here, very helpful. I wanted to mark / pin certain Questions in this forum as my favorite, private to me, under my profile. I see that there is a "favorite" url ; but not sure how to make / add a question as favorite. I did not want to use another 3rd party (fb, Linkd+etc.). Is there a way how to do this, on this Splunk site.? Initially, I had thought, if I comment on (or vote) on a specific question, it would show up in my - list of commented page.. but, I was wrong there. Any idea.. Webmaster ? ... View more

Facing terribly slow search time performance. Same worked fine with Splunk 5. Job inspector shows the following: Execution costs Duration (seconds) Component Invocations Input count Output count 0.078 command.fields 78 911,212 911,212 184.017 command.search 78 - 911,212 0.423 command.search.index 78 - - 0.078 command.search.calcfields 78 911,212 911,212 0.078 command.search.fieldalias 78 911,212 911,212 0 command.search.index.usec_64_512 4 - - 0 command.search.index.usec_8_64 127 - - 182.176 command.search.rawdata 78 - - 0.083 command.search.kv 78 - - 0.078 command.search.lookups 78 911,212 911,212 0.078 command.search.tags 78 911,212 911,212 0.078 command.search.typer 78 911,212 911,212 0.045 command.search.summary 78 - - 0.018 dispatch.check_disk_usage 18 - - 0.023 dispatch.createProviderQueue 1 - - 0.085 dispatch.evaluate 1 - - 0.085 dispatch.evaluate.search 1 - - 184.037 dispatch.fetch 78 - - 0.04 dispatch.preview 40 - - 0.008 dispatch.readEventsInResults 1 - - 184.023 dispatch.stream.local 78 - - 2.303 dispatch.timeline 78 - - 0.269 dispatch.writeStatus 119 - - 0.039 startup.handoff search log is showing thousands of these lines and search never completed so, finalized the search after x minutes. 11-dd-2013 09:15:07.587 INFO DispatchThread - Generating results preview took 1 ms 11-dd-2013 09:15:10.181 INFO DispatchThread - Generating results preview took 1 ms 11-dd-2013 09:15:12.591 INFO DispatchThread - Generating results preview took 1 ms 11-dd-2013 09:15:15.216 INFO DispatchThread - Generating results preview took 1 ms From the line 182.176 command.search.rawdata 78 The 183 seconds not totaling up to the individual times spent. Appreciate if anyone could help / shed light on this.? Thanks. Added more: My indexers are version 6 as well. I've debugged this a bit further. There is not much Disc I/O but, yes the CPU spins crazy. Actually, I let the search job run in the background. This is just 30days data of size 70GB. Each day has couple of files with records more than of size 2GB. The search job completed after 45 minutes. There could something wrong with my indexing. Here is the completed job inspector shows: 703.171 command.prestats 23,639 295,181,393 122,367 1,725.204 command.search 23,677 - 295,181,829 1,021.454 command.search.rawdata 23,638 - - 524.957 command.search.kv 23,638 - - 23.639 command.search.lookups 23,638 295,181,393 295,181,393 23.638 command.search.calcfields 23,638 295,181,393 295,181,393 23.638 command.search.fieldalias 23,638 295,181,393 295,181,393 10.732 command.search.summary 23,677 - - 0 command.search.index.usec_1_8 26 - search log has: 11-dd-2013 hh:33:01.347 INFO loader - Detected 24 (virtual) CPUs and 193800MB RAM 11-dd-2013 hh:33:01.347 INFO loader - Maximum number of threads (approximate): 12288 11-dd-2013 hh:33:01.347 INFO loader - Arguments are: "search" "-- id=scheduler_adminlauncher_a3_at_1383438780_5" "--maxbuckets=0" "--ttl=172800" "--maxout=500000" "--maxtime=8640000" "--lookups=1" "--reduce_freq=10" "--user=admin" "--pro" "--roles=admin:can_delete:power:user" .. .. 11-dd-2013 hh:33:01.672 INFO BatchSearch - Adding bucket:mytestindex~58~0867F605-4D1D-4B32-84CD- BBB2474E0F1B to batch search with min seek addr offset:0 and max seek addr offset:0 and bucket has time range set:0 ... View more

How do we index a data file which is an aggregated data for a given day. The data does not contain timestamp. Splunk gives an error while searching- saying that "Error in IndexScopedSearch: The search failed. More than XXX events found at time t" I've looked at these forums and found the following link, which tells me its a limitation on Splunk. Max number events at the same timestamp Tuning Search with more than 250K events at one timestamp Disable timestamp processor Consider the following use-case. Imagine, you are looking at a stock price data on a day-scale for 6 months. The data file in this case, may contain ticker price for a given day. If the data points are more than 100K, since there is no timestamp, Splunk given the error during search time. Has anyone figured how to workaround this? ... View more