topic Re: Search getting cancelled remotely or expired in Splunk Search

Search getting cancelled remotely or expired

renjujacob88 — Tue, 24 Jul 2018 04:19:27 GMT

HI Splunkers,

When running a search with inputlookup command, I suddenly see the following error messages. This is popping up all the time when i use the inputlookup command.

Below is the sample query used:

index=wineventlog src_user!="$" EventCode=4725 user!="$" sourcetype="WinEventLog:Security" [inputlookup Disabled | fields user ] | stats count by user

Is there any workaround on this issue.

Re: Search getting cancelled remotely or expired

Shan — Tue, 24 Jul 2018 05:11:38 GMT

@ renjujacob88

Please take a look into previous answers for the same issue. I believe it will help you. how long is your query running.

https://answers.splunk.com/answers/107674/unknown-sid-error-when-doing-multiple-searches.html
https://answers.splunk.com/answers/22969/getting-an-error-banner-http-404-text-unknown-sid-code-none-type-fatal-when-searching-in-splunk-web-and-no-results.html

Thanks,
Shankar

Re: Search getting cancelled remotely or expired

renjujacob88 — Tue, 24 Jul 2018 05:58:52 GMT

@shankarananth
search query is runing for last 7 days and the lookup contains 1300 users only still popping up the errors

Re: Search getting cancelled remotely or expired

renjujacob88 — Wed, 25 Jul 2018 05:17:33 GMT

Looks like the admin team has upgraded to the latest version 7.0.3.6 and after the upgrade only i'm seeing this issue. The lookup file contains just 1000+ entries and when its used with the lookup command its failing miserably . Does it has to do with the physical memory.?

I can't believe that the splunk cant parse the results with lookup file having 1000 entries for even last 60 minutes

index=wineventlog src_user!="$" EventCode=4725 user!="$" sourcetype="WinEventLog:Security" [|inputlookup Disabled | fields user ] | stats count by user