Dashboards & Visualizations

What causes "Search auto-canceled"?

cblanton
Communicator

The full error message is "Search auto-canceled The search job has failed due to an error. You may be able view the job in the Job Inspector."

The error occurs once in a while on our dashboard and after some time (usually within minutes) it resolves itself.

Tags (1)
1 Solution

woodcock
Esteemed Legend

Usually this is because your Search Head uses up all available RAM and there is no more to be had so existing searches cannot get the RAM they need and have to abort. Best Practice is to get all the RAM that you possibly can for your Search Head.

View solution in original post

woodcock
Esteemed Legend

Another reason is that your search is hitting one of these defaults (configurable in the Advanced edit section of your saved search):

dispatch.max_count = <integer>
* The maximum number of results before finalizing the search.
* Defaults to 500000.

dispatch.max_time = <integer>
* Indicates the maximum amount of time (in seconds) before finalizing the
  search.
* Defaults to 0.

See here:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Savedsearchesconf

wdeguara
Explorer

Would the same reasoning apply if you are using Splunk Cloud ?

0 Karma

gjanders
SplunkTrust
SplunkTrust

The max_time should result in an auto-finalized statement but this goes into the info.csv file which is not indexed by default.

If you use Alerts for Splunk Admins or github refer to "SearchHeadLevel - Users with auto-finalized searches"

jcooper_tzt
Explorer

I'm currently at a customer site and am seeing the same behavior and I can say that the memory is definitely not running out. We are baffled as well, it happens regularly, but is also intermittent. Same search will complete some of the time, and then a more often than not fail.

Customer is running 7.1.4, and I don't see anything in the release notes that would explain this behavior. We are going to be opening a support ticket to look into it.

woodcock
Esteemed Legend

Usually this is because your Search Head uses up all available RAM and there is no more to be had so existing searches cannot get the RAM they need and have to abort. Best Practice is to get all the RAM that you possibly can for your Search Head.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...