Dashboards & Visualizations

What causes "Search auto-canceled"?

cblanton
Communicator

The full error message is "Search auto-canceled The search job has failed due to an error. You may be able view the job in the Job Inspector."

The error occurs once in a while on our dashboard and after some time (usually within minutes) it resolves itself.

Tags (1)
1 Solution

woodcock
Esteemed Legend

Usually this is because your Search Head uses up all available RAM and there is no more to be had so existing searches cannot get the RAM they need and have to abort. Best Practice is to get all the RAM that you possibly can for your Search Head.

View solution in original post

woodcock
Esteemed Legend

Another reason is that your search is hitting one of these defaults (configurable in the Advanced edit section of your saved search):

dispatch.max_count = <integer>
* The maximum number of results before finalizing the search.
* Defaults to 500000.

dispatch.max_time = <integer>
* Indicates the maximum amount of time (in seconds) before finalizing the
  search.
* Defaults to 0.

See here:
https://docs.splunk.com/Documentation/Splunk/latest/Admin/Savedsearchesconf

wdeguara
Explorer

Would the same reasoning apply if you are using Splunk Cloud ?

0 Karma

gjanders
SplunkTrust
SplunkTrust

The max_time should result in an auto-finalized statement but this goes into the info.csv file which is not indexed by default.

If you use Alerts for Splunk Admins or github refer to "SearchHeadLevel - Users with auto-finalized searches"

jcooper_tzt
Explorer

I'm currently at a customer site and am seeing the same behavior and I can say that the memory is definitely not running out. We are baffled as well, it happens regularly, but is also intermittent. Same search will complete some of the time, and then a more often than not fail.

Customer is running 7.1.4, and I don't see anything in the release notes that would explain this behavior. We are going to be opening a support ticket to look into it.

woodcock
Esteemed Legend

Usually this is because your Search Head uses up all available RAM and there is no more to be had so existing searches cannot get the RAM they need and have to abort. Best Practice is to get all the RAM that you possibly can for your Search Head.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...