topic Re: What causes "Search auto-canceled"? in Dashboards & Visualizations

What causes "Search auto-canceled"?

cblanton — Mon, 04 Feb 2019 17:08:46 GMT

The full error message is "Search auto-canceled The search job has failed due to an error. You may be able view the job in the Job Inspector."

The error occurs once in a while on our dashboard and after some time (usually within minutes) it resolves itself.

Re: What causes "Search auto-canceled"?

woodcock — Mon, 04 Feb 2019 17:44:46 GMT

Usually this is because your Search Head uses up all available RAM and there is no more to be had so existing searches cannot get the RAM they need and have to abort. Best Practice is to get all the RAM that you possibly can for your Search Head.

Re: What causes "Search auto-canceled"?

jcooper_tzt — Fri, 22 Feb 2019 16:30:51 GMT

I'm currently at a customer site and am seeing the same behavior and I can say that the memory is definitely not running out. We are baffled as well, it happens regularly, but is also intermittent. Same search will complete some of the time, and then a more often than not fail.

Customer is running 7.1.4, and I don't see anything in the release notes that would explain this behavior. We are going to be opening a support ticket to look into it.

Re: What causes "Search auto-canceled"?

woodcock — Sun, 03 Mar 2019 22:13:03 GMT

Another reason is that your search is hitting one of these defaults (configurable in the Advanced edit section of your saved search):

dispatch.max_count = <integer>
* The maximum number of results before finalizing the search.
* Defaults to 500000.

dispatch.max_time = <integer>
* Indicates the maximum amount of time (in seconds) before finalizing the
  search.
* Defaults to 0.

See here:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Savedsearchesconf

Re: What causes "Search auto-canceled"?

gjanders — Sun, 03 Mar 2019 22:25:45 GMT

The max_time should result in an auto-finalized statement but this goes into the info.csv file which is not indexed by default.

If you use Alerts for Splunk Admins or github refer to "SearchHeadLevel - Users with auto-finalized searches"

Re: What causes "Search auto-canceled"?

wdeguara — Mon, 15 Jun 2020 07:40:48 GMT

Would the same reasoning apply if you are using Splunk Cloud ?

Re: What causes "Search auto-canceled"?

joe321 — Thu, 30 May 2024 19:09:21 GMT

Did you end up solving the issue with the customer having failed serches (more often that not), but the system resources are not even being used? I am running into the same issue on 9.2.1 running on RHEL 8.