Hello,
I have a scheduled saved search which populates a summary index with ~50M events. As the search is triggered I monitor the progress in the **Job Inspector**. I noticed that **it reaches 100% in about 30mins**. After this point the search fails to report any more progress. I have checked the `search.log` and the last update is about the `"StatsProcessor - flushed stats....`" into a gzipped file in the scheduler's job directory. I also checked this directory and in the file `status.csv` it reports as "**FINALIZING**". Waiting a couple of hours and no progress. My concern is that in the flushed results reported a count of ~9M events which is correct for based on the indexed events. However I use `timechart`and then `untable` in order to fill empty buckets and this is the expansion to 50M events.
Also, scheduler's log in index `_internal` does not report any error or whatever.
Is there another log/process I could check to gather more details?or any more ideas? My `liits.conf` are configured to handled such big queries as well.
thanks, Dimoklis
↧