Archive
Highlighted

"Search auto-canceled" error during search query , what is solution?

New Member

Good day

I configured Splunk to receive Cisco ASA firewall log on udp 5141 port and installed ASA add-on for parsing logs with "Cisco.ASA" source type.
It's necessary to say you, i received about1000000 logs per minutes.
I have problem with searching query in Splunk. when i search a simple query like: "index=fw251" (the name of asa index that receive logs is fw251) during 1h, Splunk can't send me all of logs and show this error: "Search auto-canceled" after several minutes. (just show me last 4 minutes of 60 minutes) and paused.
Why this error occur?
I monitored all of resources like ram,cpu, ... . every things is okey.
Do have any suggestion for me?

Thank you

0 Karma
Highlighted

Re: "Search auto-canceled" error during search query , what is solution?

New Member

Hi,

As per your query understood that events are more than 1000000, kindly go through the below links . Hope this helps your query!

https://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Limitsconf

https://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Savedsearchesconf#dispatch_search_options

0 Karma
Highlighted

Re: "Search auto-canceled" error during search query , what is solution?

New Member

Hi,

As per your query understood the events are more than 1000000, check the below links and Hope this helps your query!

https://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Limitsconf

https://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Savedsearchesconf#dispatch_search_options

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.