Multisearch/Multithread Splunk query failure

book

Article ID: 206162

calendar_today

Updated On:

Products

Information Centric Analytics

Issue/Introduction

Support for multisearch and multithreaded Splunk queries was introduced with ICA version 6.5.4; however, searches with 'Index = ' at the start of the search header fail. The following errors are recorded in the Splunk importer log:

[1:DEBUG] SplunkApi.MoveNext() Creating job...
[1:DEBUG] SplunkApi.MoveNext() Awaiting Job Creation...
[4:ERROR] SplunkApi.MoveNext() TaskCanceledException Count 0 - continue.
[4:ERROR] SplunkApi.MoveNext() System.Threading.Tasks.TaskCanceledException: A task was canceled.

Cause

The Splunk importer prepends a standard search term to queries that do not begin with a pipe character and exceed seven characters in length.

Environment

Release : 6.5.4

Component : Splunk Importer

Resolution

This is a confirmed defect that will be addressed in an upcoming release of ICA.