topic Searches cancelled remotely or expired in Splunk Search

Searches cancelled remotely or expired

tlabue — Tue, 14 Feb 2017 13:40:59 GMT

I am currently running Splunk Enterprise 6.5.2, though this problem has persisted in one of our instances for a bit.

Everytime a search is attempted, we immediately get the familiar messages that it was cancelled remotely.

I've read the other entries in Answers and none of the suggestions seemed to work.

We are running a single node instance and the server clock seems to be in order.

I have raised the value of ttl in the limits.conf, but to no avail:
[server]
ttl=1800

What else should I be looking for to get this issue resolved?

Thanks,
Tom

Re: Searches cancelled remotely or expired

mbadhusha_splun — Tue, 29 Sep 2020 21:29:27 GMT

This error means that the search artifact (the file package containing the search results) requested by Splunk Web could not be found in $SPLUNK_HOME/var/run/splunk/dispatch for the search that was just dispatched.

This problem commonly happens when the $SPLUNK_HOME/var/run/dispatch directory is hosted on a network device with a time setting behind the system clock of the operating system where splunkd is running.

What happens then is that the search artifacts are created in the dispatch directory with a modification time behind the system time known to splunkd.

Verify the time difference between your indexers/search head and check your system clocks and make sure they are all in sync. (Using NTP)

This is a known issue for some of the Splunk versions, and below is the workaround to fix this issue.

Under $SPLUNK_HOME/etc/system/local/limits.conf, add

[search]
min_settings_period = 60

Note: This is in seconds. Defaults to 1 second.

Re: Searches cancelled remotely or expired

vinkumar_splunk — Tue, 09 Oct 2018 07:14:36 GMT

It worked. thanks !!

Re: Searches cancelled remotely or expired

mic — Tue, 29 Sep 2020 21:46:55 GMT

I believe it's [search] stanza that would make it to work

$SPLUNK_HOME/etc/system/local/limits.conf
[search]
min_settings_period = 60

Re: Searches cancelled remotely or expired

mbadhusha_splun — Wed, 31 Oct 2018 11:12:22 GMT

Thanks, mate. It was a typo.