topic Re: Splunk Ad-hoc search getting auto-cancelled randomly in Splunk Search

Splunk Ad-hoc search getting auto-cancelled randomly

sagaraverma — Sun, 02 Aug 2020 17:00:30 GMT

My Ad-hoc searches getting auto-cancelled randomly.
I am running them with admin privileges.
There's no problem with RAM.
DO not have any limits.conf or authorize.conf under system/local

Re: Splunk Ad-hoc search getting auto-cancelled randomly

isoutamo — Sun, 02 Aug 2020 17:07:49 GMT

what you found when you are looking job inspection?

r. Ismo

Re: Splunk Ad-hoc search getting auto-cancelled randomly

sagaraverma — Mon, 03 Aug 2020 10:43:46 GMT

Nothing important into inspection search logs .

A single line that differs into successful and unsuccessful run is -

ReducedPhaseExecution status=failed

Re: Splunk Ad-hoc search getting auto-cancelled randomly

isoutamo — Mon, 03 Aug 2020 17:15:22 GMT

Have you SH or SHC?

Any errors in internal logs?

Re: Splunk Ad-hoc search getting auto-cancelled randomly

sagaraverma — Mon, 03 Aug 2020 19:42:12 GMT

No such message around error that can expose some hint ..and that’s really strange.

I suspect some kind of limit is getting applied via limits.conf from system/default since we do not have any set under system/local but then there hundreds of default limits and no clue for which one should be looked at ..

Re: Splunk Ad-hoc search getting auto-cancelled randomly

sagaraverma — Mon, 03 Aug 2020 19:42:54 GMT

Stand-alone SH connected to clustered search peers

Re: Splunk Ad-hoc search getting auto-cancelled randomly

isoutamo — Tue, 04 Aug 2020 16:19:14 GMT

Have you tried to send a job to background? Is it working or not on that way?
Is there FW or some other network equipments between sh and IDX cluster?

What is latency and realibilty between nodes?