topic Re: Display error :Could not create search in Splunk Search

Display error :Could not create search

kavana — Wed, 04 Jan 2017 07:08:07 GMT

create many query in panels, but some panels can display right search result, some can not and display the error:Could not create search .

I deleted some panels so that all the panels can display right search result.

So, are there too many query or SPL in my APP?

By the way, the error panels were different when run the search each time（error display in which panels are look like random）.

＜updated＞
I change the IE to Chrome then run the search again, everything gonna be OK !
Is it bug for splunk ?
How to fix it if I have to use IE ?

Re: Display error :Could not create search

kalianov — Tue, 29 Sep 2020 12:15:22 GMT

I think you need to check parameters (base_max_searches, max_searches_per_cpu, max_rt_search_multiplier) in file limits.conf in [search] section.
Caution: do not change limits.conf settings unless you know what you are doing.
http://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Limitsconf#.5Bsearch.5D

Also read this:
http://docs.splunk.com/Documentation/Splunk/6.5.1/Report/Configurethepriorityofscheduledreports

Re: Display error :Could not create search

niketn — Thu, 05 Jan 2017 05:04:30 GMT

Have you used post processing in your search queries?
Are you passing statistically aggregated data or raw events through post processing?
Also how many queries are you trying to run?

Re: Display error :Could not create search

kavana — Tue, 29 Sep 2020 12:15:55 GMT

Thank you so much!

The default value of 「base_max_searches」 in limits.conf is 6, I increaseｄ the value(to 100) then all the panels also can be run in IE and no error.

Re: Display error :Could not create search

kavana — Thu, 05 Jan 2017 05:35:43 GMT

unfortunately, Just first time to run the searches are OK.

The error happens again after first time in IE....

Re: Display error :Could not create search

kavana — Fri, 06 Jan 2017 03:59:52 GMT

Sorry,I'm rookie about splunk.
How can I distinguish if I used post processing ?

Re: Display error :Could not create search

niketn — Fri, 06 Jan 2017 04:16:32 GMT

In your <search> tags do you see id="<SomeSearchName>" and then base="<SomeSearchName>" ?

Re: Display error :Could not create search

niketn — Fri, 06 Jan 2017 04:18:07 GMT

Also check your earliest and latest tags whether there is realtime searh rt used or not.

Re: Display error :Could not create search

kavana — Fri, 06 Jan 2017 05:19:59 GMT

There is no id="" and then base="" in tags.

Re: Display error :Could not create search

kalianov — Tue, 29 Sep 2020 12:25:54 GMT

base_max_searches = 100 is too much.

max_hist_searches = max_searches_per_cpu x number_of_cpus + base_max_searches

max_rt_searches = max_rt_search_multiplier x max_hist_searches

Re: Display error :Could not create search

Cuyose — Thu, 09 Nov 2017 16:48:11 GMT

This has not helped my situation. We are not receiving any errors I can find in the logs however routinely receive "Could not create search" in dashboard panels randomly.

Re: Display error :Could not create search

eregon — Wed, 03 Apr 2019 08:54:49 GMT

You should check what are the hardware resources of your respective search-head (or maybe you have a single-instance Splunk?) and what are the hardware resources of the machine you are using to display your dashboard (your workstation/notebook/...). "Could not create search" is caused by timeout, and it may have causes on both server and client side.

On client-side, this may be caused (among other causes) by slow processing in client-side browser. This corresponds to your experience of Chrome suffering less than IE (Chrome is known to be more efficient). Try to display your dashboard on more powerful computer (or at least kill all other applications and browser tabs).

If the problem is in insufficient resources of the search-head (you should see constantly high CPU load, check your monitoring console), try to reduce the load by reducing the number of concurrent searches (eg. remove some panels) and/or simplyfying your queries. You should also consider upgrading your server hardware.

Increasing values in limits.conf (as discussed under the other answer) can actually make things worse in such case (it is like bringing even more traffic to a street suffering from regular traffic jams). Tuning the limits is rather complex topic that can not be explained in a short answer here and is affected by many aspects (including your topology etc.). Without good understanding of how Splunk works under the hood, this might be a kind of black magic. Definitely not a thing to experiment with in a production environments.

Re: Display error :Could not create search

RogerMay — Thu, 11 Apr 2019 16:04:27 GMT

I accept that various concurrent search settings can initially cause this problem, HOWEVER, the main issue for me is that even with each panel auto refreshing and the dashboard as a whole auto refreshing, the message does not go away. It is only when the browser is refreshed with an F5 that the search is retried.