What causes "Search auto-canceled"?

[cblanton]

The full error message is "Search auto-canceled The search job has failed due to an error. You may be able view the job in the Job Inspector."

The error occurs once in a while on our dashboard and after some time (usually within minutes) it resolves itself.

[woodcock]

Another reason is that your search is hitting one of these defaults (configurable in the Advanced edit section of your saved search):

dispatch.max_count = <integer>
* The maximum number of results before finalizing the search.
* Defaults to 500000.

dispatch.max_time = <integer>
* Indicates the maximum amount of time (in seconds) before finalizing the
  search.
* Defaults to 0.

See here:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Savedsearchesconf

[wdeguara]

Would the same reasoning apply if you are using Splunk Cloud ?

[gjanders]

The max_time should result in an auto-finalized statement but this goes into the info.csv file which is not indexed by default.

If you use Alerts for Splunk Admins or github refer to "SearchHeadLevel - Users with auto-finalized searches"

[jcooper_tzt]

I'm currently at a customer site and am seeing the same behavior and I can say that the memory is definitely not running out. We are baffled as well, it happens regularly, but is also intermittent. Same search will complete some of the time, and then a more often than not fail.

Customer is running 7.1.4, and I don't see anything in the release notes that would explain this behavior. We are going to be opening a support ticket to look into it.

[woodcock · Accepted solution]

Usually this is because your Search Head uses up all available RAM and there is no more to be had so existing searches cannot get the RAM they need and have to abort. Best Practice is to get all the RAM that you possibly can for your Search Head.