Dashboards & Visualizations

Dashboard "Search was cancelled"

mythili
Explorer

In our dashboard, a user reported that she got "Search was cancelled" message when she used it. I came to know that multiple searches were run concurrently. Hence, it could have been cancelled.
But when I tried to reproduce this issue, the searches kept getting queued and ran but was never delayed. 

What are the scenario when a search is queued vs when it is cancelled?

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @mythili,

there's a timeout for a search execution.

In addition you probably are an andmin and the user has different search settings.

So you could hint to your colleague to run less contemporary searches.

I don't hint to give an higher number of executable searches to that role because you could have performance issues.

You culd aso hint to your colleague to run this search in background, in this way he/she is secure that the search doesn't go in timeout.

ciao.

Giuseppe

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

The search might get cancelled if - for example - your user exceeds resource limits. If you are trying to reproduce the issue with user with another role having differently set limits (or not having limits at all) you might not hit the same restrictions.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mythili,

there's a timeout for a search execution.

In addition you probably are an andmin and the user has different search settings.

So you could hint to your colleague to run less contemporary searches.

I don't hint to give an higher number of executable searches to that role because you could have performance issues.

You culd aso hint to your colleague to run this search in background, in this way he/she is secure that the search doesn't go in timeout.

ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mythili ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...