Dashboards & Visualizations

What causes "Search auto-canceled"?

cblanton
Communicator

The full error message is "Search auto-canceled The search job has failed due to an error. You may be able view the job in the Job Inspector."

The error occurs once in a while on our dashboard and after some time (usually within minutes) it resolves itself.

Tags (1)
1 Solution

woodcock
Esteemed Legend

Usually this is because your Search Head uses up all available RAM and there is no more to be had so existing searches cannot get the RAM they need and have to abort. Best Practice is to get all the RAM that you possibly can for your Search Head.

View solution in original post

woodcock
Esteemed Legend

Another reason is that your search is hitting one of these defaults (configurable in the Advanced edit section of your saved search):

dispatch.max_count = <integer>
* The maximum number of results before finalizing the search.
* Defaults to 500000.

dispatch.max_time = <integer>
* Indicates the maximum amount of time (in seconds) before finalizing the
  search.
* Defaults to 0.

See here:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Savedsearchesconf

wdeguara
Explorer

Would the same reasoning apply if you are using Splunk Cloud ?

0 Karma

gjanders
SplunkTrust
SplunkTrust

The max_time should result in an auto-finalized statement but this goes into the info.csv file which is not indexed by default.

If you use Alerts for Splunk Admins or github refer to "SearchHeadLevel - Users with auto-finalized searches"

jcooper_tzt
Explorer

I'm currently at a customer site and am seeing the same behavior and I can say that the memory is definitely not running out. We are baffled as well, it happens regularly, but is also intermittent. Same search will complete some of the time, and then a more often than not fail.

Customer is running 7.1.4, and I don't see anything in the release notes that would explain this behavior. We are going to be opening a support ticket to look into it.

woodcock
Esteemed Legend

Usually this is because your Search Head uses up all available RAM and there is no more to be had so existing searches cannot get the RAM they need and have to abort. Best Practice is to get all the RAM that you possibly can for your Search Head.

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...