Multisearch/multithread Splunk query failure

Products

• Information Centric Analytics

Issue/Introduction

Support for multisearch and multithreaded Splunk queries was introduced with ICA version 6.5.4; however, searches with 'Index = ' at the start of the search header fail. The following errors are recorded in the Splunk importer log:

[1:DEBUG] SplunkApi.MoveNext() Creating job...
[1:DEBUG] SplunkApi.MoveNext() Awaiting Job Creation...
[4:ERROR] SplunkApi.MoveNext() TaskCanceledException Count 0 - continue.
[4:ERROR] SplunkApi.MoveNext() System.Threading.Tasks.TaskCanceledException: A task was canceled.

Environment

Release : 6.5.4

Component : Splunk Importer

Cause

The Splunk importer prepends a standard search term to queries that do not begin with a pipe character and exceed seven characters in length.

Resolution

Contact Broadcom Support for assistance if you encounter this issue.