Splunk Search

What is causing my Activity Jobs pages to be filled with subsearch entries and how do I stop this?

landen99
Motivator

Currently, I have 12.5 pages filled completely with searches which look exactly like:

| subsearch

Many of those entries appear to have the exact same Size and their run time are all 1s. Also, clicking on any of the subsearch search links brings a search page with the same lookup table displayed.

What is causing all of these ambiguous searches? How can I stop them from flooding my Job pages?

gkanapathy
Splunk Employee
Splunk Employee

I'm guessing you have a realtime search that includes a subsearch as part of the RT search.

landen99
Motivator

I found and dealt with the rt searches. The number of subsearch entries greatly reduced (down to 2 entries on the first page), but I am still interested in why these entries exist? What useful value can these entries provide to me when I am looking through my search history? How can I determine whether the rt searches were the cause or if the reduction in subsearch entries is just a coincidence?

0 Karma
Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...