topic Re: Error message above search bar in Splunk Search

Error message above search bar

bsantosh — Thu, 11 Oct 2018 06:59:11 GMT

Hi All,

When I am executing a search query something like "index=index1", I am getting the below error message above my search bar. I am still above fetch the results.

I have set the search mode to Verbose mode.

"! Some events cannot be displayed because they cannot be fetched from the remote search peer(s). This is likely caused by the natural expiration of the related remote search jobs. To view the omitted events, run the search again."

thanks,
Santosh

Re: Error message above search bar

richgalloway — Thu, 11 Oct 2018 13:34:30 GMT

Have you checked the connectivity to your indexers?

Re: Error message above search bar

bsantosh — Tue, 16 Oct 2018 08:27:07 GMT

Hi Richgalloway, thanks for your reply. I checked the connectivity with indexers and they look good.
Sorry for late reply.

Re: Error message above search bar

abeeber_3 — Thu, 25 Oct 2018 19:39:30 GMT

Have you checked your disk capacity on your SH?

I had a situation where a user reported a similar problem with one of his searches.

At the same time another user had submitted a number of searches that got stuck in the dispatch folder and ended up maxing out the disk space on the Search Server.

Once cleared, the other user's search ran as expected with out generated the error above.