I am using Dashboard Studio to build my dashboard. When loading a timechart containing a small set of events ( ~200), I frequently get a "Search <id> not found. the search may have been cancelled while there are still subscribers" error and the chart is not rendered accordingly. It does work if I click on the chart's refresh button, but that is a very bad user experience.
The timechart's data source follows the pattern below. My dashboard has two of them.
index = <index> sourcetype = <sourcetype> source = <source> host = <host> | multikv fields <fieldA> <fieldB> filter <condition> | timechart avg(fieldA) avg(fieldB)
@gciotto - Ask your Splunk admins if there is a resource-limit or time-limit imposed at the user or role level, that could be canceling the searching. (With Workload Rules)
I hope this helps!! Upvote if it does!!!