Dashboards & Visualizations

Dashboard "Search was cancelled"

mythili
Explorer

In our dashboard, a user reported that she got "Search was cancelled" message when she used it. I came to know that multiple searches were run concurrently. Hence, it could have been cancelled.
But when I tried to reproduce this issue, the searches kept getting queued and ran but was never delayed. 

What are the scenario when a search is queued vs when it is cancelled?

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

The search might get cancelled if - for example - your user exceeds resource limits. If you are trying to reproduce the issue with user with another role having differently set limits (or not having limits at all) you might not hit the same restrictions.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mythili,

there's a timeout for a search execution.

In addition you probably are an andmin and the user has different search settings.

So you could hint to your colleague to run less contemporary searches.

I don't hint to give an higher number of executable searches to that role because you could have performance issues.

You culd aso hint to your colleague to run this search in background, in this way he/she is secure that the search doesn't go in timeout.

ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...