topic Re: "Unknown sid" Error when doing multiple searches in Security

"Unknown sid" Error when doing multiple searches

ibbsplunk — Wed, 23 Oct 2013 20:05:16 GMT

When I run multiple searches sometimes I get the "Unknown sid" with the orange triangle and exclamation mark under the search bar. When that happens this causes the search to not move forward. This also causes that I cannot pause or stop the search.

Re: "Unknown sid" Error when doing multiple searches

mrflibbleuk — Fri, 28 Feb 2014 01:51:53 GMT

Yes I am hitting the same issue with a particularly large query comprised of a few million records. Has anyone found a way to resolve this issue? is it a resource problem?

Re: "Unknown sid" Error when doing multiple searches

deepakmurthy — Thu, 22 May 2014 19:14:03 GMT

I am having the same issue, was there a solution for this issue.

Re: "Unknown sid" Error when doing multiple searches

obhatti — Thu, 22 May 2014 19:22:23 GMT

No solution was found but I found a workaround. After starting search, go to Jobs page under Activity from top right hand corner. Then hit Save for the search you are running.

For me, this error usually happens on long searches and this workaround helped.

Re: "Unknown sid" Error when doing multiple searches

Olli1919 — Wed, 28 May 2014 10:26:02 GMT

I am also getting this error frequently, on long running foreground searches. Maybe someone can give some insight were on possible root causes? Are there possibly some connections in the background timing out and are being dropped?

Re: "Unknown sid" Error when doing multiple searches

somesoni2 — Wed, 28 May 2014 21:21:04 GMT

Is your error similar to this?
http://answers.splunk.com/answers/22969/getting-an-error-banner-http-404-textunknown-sidcode-none-type-fatal-when-searching-in-splunk-web-and-no-results

Re: "Unknown sid" Error when doing multiple searches

deepakmurthy — Fri, 30 May 2014 16:26:24 GMT

Unknown sid is basically time out, when your search query times out or looses any network connection - it sends displays Unknown Sid.

Reduce your data input size of the index, only index for a few months
or reduce regular expression transformation in props.conf file.

Inspect the job and see where the time consuming part is. you should be able to identify the cause of it.

Hopefully this would help you.

Also the other solution posted here is also good to review.
http://answers.splunk.com/answers/22969/getting-an-error-banner-http-404-textunknown-sidcode-none-type-fatal-when-searching-in-splunk-web-and-no-results

I didnt have issue with dispatch directory. I had to reduce input size and also reduce my regular expression.