https://community.splunk.com/t5/Splunk-Search/Why-Splunk-search-jobs-stuck-at-quot-finalizing-job-quot-status/m-p/418644#M173532 <P>Symptoms:</P> <UL> <LI><P>It usually happen in the next couple of hours after we manually deleted the stuck search jobs </P></LI> <LI><P>It only happens to particular searches </P></LI> <LI><P>Once it happens, how long the affected search is stuck with the status of "finalizing"? </P></LI> <LI><P>The affected search jobs is stuck with the status of "finalizing" until we manually deleted them.</P></LI> <LI><P>Job status says 100% completed according to job inspection(when viewed via "Inspet Job")</P></LI> </UL> Sat, 19 Jan 2019 08:34:46 GMT sdubey_splunk 2019-01-19T08:34:46Z https://community.splunk.com/t5/Splunk-Search/Why-Splunk-search-jobs-stuck-at-quot-finalizing-job-quot-status/m-p/418644#M173532 <P>Symptoms:</P> <UL> <LI><P>It usually happen in the next couple of hours after we manually deleted the stuck search jobs </P></LI> <LI><P>It only happens to particular searches </P></LI> <LI><P>Once it happens, how long the affected search is stuck with the status of "finalizing"? </P></LI> <LI><P>The affected search jobs is stuck with the status of "finalizing" until we manually deleted them.</P></LI> <LI><P>Job status says 100% completed according to job inspection(when viewed via "Inspet Job")</P></LI> </UL> Sat, 19 Jan 2019 08:34:46 GMT https://community.splunk.com/t5/Splunk-Search/Why-Splunk-search-jobs-stuck-at-quot-finalizing-job-quot-status/m-p/418644#M173532 sdubey_splunk 2019-01-19T08:34:46Z https://community.splunk.com/t5/Splunk-Search/Why-Splunk-search-jobs-stuck-at-quot-finalizing-job-quot-status/m-p/418645#M173533 <P>Solution:<BR /> 1. bump up max_chunk_queue_size in limits.conf in the search heads. <BR /> That will reduce the necessity for pausing search result collation queues, which makes hitting the issue less likely</P> <H1>limit.conf : Updated below parameters to fix the issue. </H1> <P>[search] <BR /> result_queue_max_size = 200000000 <BR /> max_chunk_queue_size = 5000000 <BR /> fetch_remote_search_log = false </P> <H1>remote_timeline_fetchall = false </H1> <P>Details about above paramters. </P> <P>result_queue_max_size = <BR /> * The maximum size, in MB, that will be kept from peers for processing on <BR /> the search head before throttling the rate that data is accepted.<BR /> * The “results_queue_min_size” value takes precedence. The number of search<BR /> results chunks specified by “results_queue_min_size” will always be <BR /> retained in the queue even if the combined size in MB exceeds the <BR /> “result_queue_max_size” value. <BR /> * Default: 100</P> <P>max_chunk_queue_size = <BR /> * The maximum size of the chunk queue.<BR /> * default: 10000000</P> <P>Updating above parameters reduced the necessity for pausing search result collation queues, which makes hitting the issue less likely. And this fixed our issue.</P> Tue, 29 Sep 2020 22:52:43 GMT https://community.splunk.com/t5/Splunk-Search/Why-Splunk-search-jobs-stuck-at-quot-finalizing-job-quot-status/m-p/418645#M173533 sdubey_splunk 2020-09-29T22:52:43Z https://community.splunk.com/t5/Splunk-Search/Why-Splunk-search-jobs-stuck-at-quot-finalizing-job-quot-status/m-p/418646#M173534 <P>Great question/answer, please accept your answer unless your waiting for alternative answers!</P> Sun, 20 Jan 2019 22:07:44 GMT https://community.splunk.com/t5/Splunk-Search/Why-Splunk-search-jobs-stuck-at-quot-finalizing-job-quot-status/m-p/418646#M173534 gjanders 2019-01-20T22:07:44Z https://community.splunk.com/t5/Splunk-Search/Why-Splunk-search-jobs-stuck-at-quot-finalizing-job-quot-status/m-p/747458#M241825 <P>Are these changes still relevant as of 2025?</P><P>&nbsp;</P> Wed, 04 Jun 2025 08:47:23 GMT https://community.splunk.com/t5/Splunk-Search/Why-Splunk-search-jobs-stuck-at-quot-finalizing-job-quot-status/m-p/747458#M241825 oren_s 2025-06-04T08:47:23Z