https://community.splunk.com/t5/Deployment-Architecture/Multisite-Distributed-Search-Why-am-I-getting-search-head-error/m-p/255838#M9692 <P>I found an open bug ticket with similar symptoms. Please open a case with Splunk support and provide a diag from your search head and at least one of your indexers.</P> Wed, 27 Jan 2016 19:00:14 GMT s2_splunk 2016-01-27T19:00:14Z https://community.splunk.com/t5/Deployment-Architecture/Multisite-Distributed-Search-Why-am-I-getting-search-head-error/m-p/255837#M9691 <P>Hi,</P> <P>In a multisite distributed search environment with 1 search head and 4 indexers, it seems that the Search Head has difficulties to retrieve answers from the different indexers. Found this error in the search result of the search head :</P> <PRE><CODE>ERROR SearchResultParserExecutor - Encountered an error deserializing SearchResultsInfo from ResultsStream header. </CODE></PRE> <P>Anybody knows if it linked and how to fix it?<BR /> Splunk Entreprise 6.3.1</P> Wed, 27 Jan 2016 15:24:15 GMT https://community.splunk.com/t5/Deployment-Architecture/Multisite-Distributed-Search-Why-am-I-getting-search-head-error/m-p/255837#M9691 andrearodrigues 2016-01-27T15:24:15Z https://community.splunk.com/t5/Deployment-Architecture/Multisite-Distributed-Search-Why-am-I-getting-search-head-error/m-p/255838#M9692 <P>I found an open bug ticket with similar symptoms. Please open a case with Splunk support and provide a diag from your search head and at least one of your indexers.</P> Wed, 27 Jan 2016 19:00:14 GMT https://community.splunk.com/t5/Deployment-Architecture/Multisite-Distributed-Search-Why-am-I-getting-search-head-error/m-p/255838#M9692 s2_splunk 2016-01-27T19:00:14Z https://community.splunk.com/t5/Deployment-Architecture/Multisite-Distributed-Search-Why-am-I-getting-search-head-error/m-p/255839#M9693 <P>Is this a bug? What is the SPL code? I am seeing these errors in a large environment I am currently working with. It is also running 6.3.1. Thanks. It appears to jam the search, then after a number of seconds it then continues and results are displayed.</P> Tue, 23 Feb 2016 20:46:31 GMT https://community.splunk.com/t5/Deployment-Architecture/Multisite-Distributed-Search-Why-am-I-getting-search-head-error/m-p/255839#M9693 pj 2016-02-23T20:46:31Z https://community.splunk.com/t5/Deployment-Architecture/Multisite-Distributed-Search-Why-am-I-getting-search-head-error/m-p/255840#M9694 <P>Ditto, Saw it on an adhoc search and took too long to respond on the SHC. </P> <P>04-07-2016 07:37:44.753 INFO DistributedSearchResultCollectionManager - Successfully created search result collector for peer=deindexer in 0.112000 seconds<BR /> 04-07-2016 07:37:44.755 INFO DistributedSearchResultCollectionManager - Successfully created search result collector for peer=irindexer1 in 0.002000 seconds<BR /> 04-07-2016 07:37:44.757 INFO DistributedSearchResultCollectionManager - Successfully created search result collector for peer=irindexer2 in 0.002000 seconds<BR /> 04-07-2016 07:37:44.757 INFO UserManager - Setting user context: bp9906<BR /> 04-07-2016 07:37:44.757 INFO UserManager - Done setting user context: NULL -&gt; bp9906<BR /> 04-07-2016 07:37:44.761 INFO DispatchThread - Disk quota = 10485760000<BR /> 04-07-2016 07:37:45.941 ERROR SearchResultParserExecutor - Encountered an error deserializing SearchResultsInfo from ResultsStream header.<BR /> 04-07-2016 07:37:45.943 INFO DispatchThread - Generating results preview took 1 ms<BR /> 04-07-2016 07:37:47.542 INFO DispatchThread - Generating results preview took 1 ms<BR /> 04-07-2016 07:37:49.510 INFO DispatchThread - Generating results preview took 1 ms<BR /> 04-07-2016 07:37:51.700 INFO DispatchThread - Generating results preview took 1 ms<BR /> 04-07-2016 07:37:52.770 INFO DispatchThread - Generating results preview took 1 ms<BR /> 04-07-2016 07:37:53.844 INFO DispatchThread - Generating results preview took 1 ms<BR /> 04-07-2016 07:37:55.042 INFO DispatchThread - Generating results preview took 1 ms<BR /> 04-07-2016 07:38:01.782 INFO DispatchThread - Generating results preview took 1 ms</P> Thu, 07 Apr 2016 15:00:21 GMT https://community.splunk.com/t5/Deployment-Architecture/Multisite-Distributed-Search-Why-am-I-getting-search-head-error/m-p/255840#M9694 BP9906 2016-04-07T15:00:21Z https://community.splunk.com/t5/Deployment-Architecture/Multisite-Distributed-Search-Why-am-I-getting-search-head-error/m-p/255841#M9695 <P>Hi,</P> <P>Case opened with Splunk on this issue. Indexers randomly missing when performing search form the SH on various index. It seems to be linked with this error, moreover we don't have it in the search.log when all indexers are displayed in the splunk-server field (i.e for a search with no problem).</P> Thu, 07 Apr 2016 15:54:45 GMT https://community.splunk.com/t5/Deployment-Architecture/Multisite-Distributed-Search-Why-am-I-getting-search-head-error/m-p/255841#M9695 andrearodrigues 2016-04-07T15:54:45Z https://community.splunk.com/t5/Deployment-Architecture/Multisite-Distributed-Search-Why-am-I-getting-search-head-error/m-p/255842#M9696 <P>plus 1; where is the SPL code to follow up on?</P> Wed, 13 Apr 2016 00:51:04 GMT https://community.splunk.com/t5/Deployment-Architecture/Multisite-Distributed-Search-Why-am-I-getting-search-head-error/m-p/255842#M9696 ben_leung 2016-04-13T00:51:04Z https://community.splunk.com/t5/Deployment-Architecture/Multisite-Distributed-Search-Why-am-I-getting-search-head-error/m-p/255843#M9697 <P>Hi,</P> <P>Update : </P> <P>We noticed that issue also happens when performing search on the _audit index !! As you can see below only 3 of the 4 indexers retreive informations<BR /><BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/1011iB68E720AC56E0C0C/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Wed, 13 Apr 2016 10:08:00 GMT https://community.splunk.com/t5/Deployment-Architecture/Multisite-Distributed-Search-Why-am-I-getting-search-head-error/m-p/255843#M9697 andrearodrigues 2016-04-13T10:08:00Z