Randomly problems when execute a search

splunk_soc360 — Wed, 30 Sep 2020 05:18:45 GMT

Hi,

Since a few months I have random problems when I try to execute a search that works correctly.
The problem is that sometimes the job of the search returns the following exception:

"""
X errors occurred while the search was executing. Therefore, search results might be incomplete.
Dispatch Command: Unknown error for indexer: my_search_head_0X. Search Results might be incomplete! If this occurs frequently, please check on the peer.
"""

This error show up problems in each Search Head that I have.
How I said this is random because if I try to execute again the same query after the error it shows me the results.

Anybody can help me to fix this or understand why is happening this.

Thanks.

Re: Randomly problems when execute a search

ololdach — Wed, 06 May 2020 14:14:11 GMT

Hi,

you need to find the root cause for the error. On the splunk UI, dropdown "Job" and select "Inspect Job" to open the job inspector of a failed query. In the Job inspector window, look for the "search.log" link and click it. In the log, search for the words "WARN" or "ERROR"

Once you know the root cause for the problem, we could probably help you to avoid it in the future.

Hope it helps,
Oliver

topic Re: Randomly problems when execute a search in Splunk Enterprise Security

Randomly problems when execute a search

Re: Randomly problems when execute a search