Dashboard "Search was cancelled"

[mythili]

In our dashboard, a user reported that she got "Search was cancelled" message when she used it. I came to know that multiple searches were run concurrently. Hence, it could have been cancelled.
But when I tried to reproduce this issue, the searches kept getting queued and ran but was never delayed. 

What are the scenario when a search is queued vs when it is cancelled?

[PickleRick]

The search might get cancelled if - for example - your user exceeds resource limits. If you are trying to reproduce the issue with user with another role having differently set limits (or not having limits at all) you might not hit the same restrictions.

[gcusello · Accepted solution]

Hi @mythili,

there's a timeout for a search execution.

In addition you probably are an andmin and the user has different search settings.

So you could hint to your colleague to run less contemporary searches.

I don't hint to give an higher number of executable searches to that role because you could have performance issues.

You culd aso hint to your colleague to run this search in background, in this way he/she is secure that the search doesn't go in timeout.

ciao.

Giuseppe

[gcusello]

Hi @mythili ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉