https://community.splunk.com/t5/Splunk-Search/EventsViewer-module-Cannot-access-search-data-job-1299545325-41/m-p/55452#M13536 <P>This message is telling you the search is a zombie.</P> <P>The specific line of code that makes this determination in splunkd is:</P> <PRE><CODE>bool isZombie = !(isDone || ScopedAliveProcessToken::isAlive(ddir / ALIVE_TOKEN)); </CODE></PRE> <P>Ie, if it is not done, and not still alive, it is a zombie. In other words, this is a search that crashed (or somehow otherwise stopped talking to the outside world), but still left some stuff lying around (which will be cleaned up later). So the search artifacts exist in some state, and you can identify that the job once existed, but it probably isn't useful for information for making IT decisions etc about.</P> <P>The token is typically a named pipe, so you could have a case where the named pipe failed to be created or opened (permissions, fd exhaustion) but most likely there was a crash.</P> <P>Check the var/log/splunk directory for crashlogs, and if you're getting them, create a diag and work with support. (both of these are talked about here)</P> <P>and eventually create a support case.</P> Tue, 08 Mar 2011 12:20:04 GMT jrodman 2011-03-08T12:20:04Z https://community.splunk.com/t5/Splunk-Search/EventsViewer-module-Cannot-access-search-data-job-1299545325-41/m-p/55451#M13535 <P>I reinstalled splunk to a different volume and now I get this message when trying to search for any string. How can I fix this ? </P> Tue, 08 Mar 2011 08:58:05 GMT https://community.splunk.com/t5/Splunk-Search/EventsViewer-module-Cannot-access-search-data-job-1299545325-41/m-p/55451#M13535 timstiles 2011-03-08T08:58:05Z https://community.splunk.com/t5/Splunk-Search/EventsViewer-module-Cannot-access-search-data-job-1299545325-41/m-p/55452#M13536 <P>This message is telling you the search is a zombie.</P> <P>The specific line of code that makes this determination in splunkd is:</P> <PRE><CODE>bool isZombie = !(isDone || ScopedAliveProcessToken::isAlive(ddir / ALIVE_TOKEN)); </CODE></PRE> <P>Ie, if it is not done, and not still alive, it is a zombie. In other words, this is a search that crashed (or somehow otherwise stopped talking to the outside world), but still left some stuff lying around (which will be cleaned up later). So the search artifacts exist in some state, and you can identify that the job once existed, but it probably isn't useful for information for making IT decisions etc about.</P> <P>The token is typically a named pipe, so you could have a case where the named pipe failed to be created or opened (permissions, fd exhaustion) but most likely there was a crash.</P> <P>Check the var/log/splunk directory for crashlogs, and if you're getting them, create a diag and work with support. (both of these are talked about here)</P> <P>and eventually create a support case.</P> Tue, 08 Mar 2011 12:20:04 GMT https://community.splunk.com/t5/Splunk-Search/EventsViewer-module-Cannot-access-search-data-job-1299545325-41/m-p/55452#M13536 jrodman 2011-03-08T12:20:04Z https://community.splunk.com/t5/Splunk-Search/EventsViewer-module-Cannot-access-search-data-job-1299545325-41/m-p/55453#M13537 <P>Wont the search crash logs be over in /var/run/dispatch/1299545325.41/ ? Or does it write crash logs out to the splunk's logs too?</P> Tue, 08 Mar 2011 15:32:42 GMT https://community.splunk.com/t5/Splunk-Search/EventsViewer-module-Cannot-access-search-data-job-1299545325-41/m-p/55453#M13537 sideview 2011-03-08T15:32:42Z https://community.splunk.com/t5/Splunk-Search/EventsViewer-module-Cannot-access-search-data-job-1299545325-41/m-p/55454#M13538 <P>are there any errors/warnings in $SPLUNK_HOME/var/run/splunk/dispatch/1299545325.41/search.log?</P> Tue, 08 Mar 2011 16:50:52 GMT https://community.splunk.com/t5/Splunk-Search/EventsViewer-module-Cannot-access-search-data-job-1299545325-41/m-p/55454#M13538 Ledion_Bitincka 2011-03-08T16:50:52Z https://community.splunk.com/t5/Splunk-Search/EventsViewer-module-Cannot-access-search-data-job-1299545325-41/m-p/55455#M13539 <P>@nick - nope, all crashlogs go to $SPLUNK_HOME/var/logs/</P> Tue, 08 Mar 2011 16:52:37 GMT https://community.splunk.com/t5/Splunk-Search/EventsViewer-module-Cannot-access-search-data-job-1299545325-41/m-p/55455#M13539 Ledion_Bitincka 2011-03-08T16:52:37Z