topic Re: Dashboard Studio: "Search <id> not found. the search may have been cancelled while there are still subscr in Dashboards & Visualizations

Dashboard Studio: "Search not found. the search may have been cancelled while there are still subscribers"

gciotto — Wed, 07 Jun 2023 11:10:43 GMT

Hi,

I am using Dashboard Studio to build my dashboard. When loading a timechart containing a small set of events ( ~200), I frequently get a "Search <id> not found. the search may have been cancelled while there are still subscribers" error and the chart is not rendered accordingly. It does work if I click on the chart's refresh button, but that is a very bad user experience.

The timechart's data source follows the pattern below. My dashboard has two of them.

index = <index> sourcetype = <sourcetype> source = <source> host = <host> | multikv fields <fieldA> <fieldB> filter <condition> | timechart avg(fieldA) avg(fieldB)

Best regards,

Gustavo

Re: Dashboard Studio: "Search not found. the search may have been cancelled while there are still subscr

VatsalJagani — Thu, 08 Jun 2023 06:39:25 GMT

@gciotto - Ask your Splunk admins if there is a resource-limit or time-limit imposed at the user or role level, that could be canceling the searching. (With Workload Rules)

I hope this helps!! Upvote if it does!!!

Re: Dashboard Studio: "Search not found. the search may have been cancelled while there are still subscr

gciotto — Mon, 12 Jun 2023 11:37:47 GMT

Hi @VatsalJagani , thank you for your comment.

The only solution that we found was to migrate our dashboards to the classic mode. The exact same queries worked fine in this mode.

Gustavo

Re: Dashboard Studio: "Search not found. the search may have been cancelled while there are still subscr

VatsalJagani — Mon, 12 Jun 2023 11:59:49 GMT

Weird behavior though!!! But great it worked for you!!! Kindly accept your answer for future community users.

Kindly upvote if you find my comment helpful!!!

Re: Dashboard Studio: "Search not found. the search may have been cancelled while there are still subscr

emlin_charly — Tue, 23 Jan 2024 18:54:14 GMT

This is due to issues with load balancers sitting in front of the hosts. Check the stickiness of the load balancers. Accessing a SH member directly should solve it.

Re: Dashboard Studio: "Search not found. the search may have been cancelled while there are still subscr

twollenslegel_s — Thu, 18 Sep 2025 17:06:02 GMT

This is a known issue; Splunk is currently working on improving this issue, no ETA, but expect to see improvements in a version > 10.0.