Installation

Why are searches stuck at "finalizing job" after upgrade to 6.5.0?

Communicator

I upgraded Splunk on my linux server to 6.5.0 and after that no searches are getting completed. Not even index=_internal

Search job inspector also doesn't load.

All the jobs are getting stuck at 'finalizing job'. Tried bouncing Splunk web services as I was occasionally getting error as "Connection to Splunk server lost."

Any solution please??

Labels (2)
1 Solution

Splunk Employee
Splunk Employee

search is always "parsing...." after upgrading to 6.5 from 6.3.2 - SPL-129476

This is actually caused by stale files remaining in cache after the upgrade. If you haven't all ready done so, try clearing browser cache and retry the search. This has helped quite a few customers reporting this issue.

View solution in original post

Engager

Hit Shift-F5 on the search page. Was browser cache for us.

0 Karma

Splunk Employee
Splunk Employee

search is always "parsing...." after upgrading to 6.5 from 6.3.2 - SPL-129476

This is actually caused by stale files remaining in cache after the upgrade. If you haven't all ready done so, try clearing browser cache and retry the search. This has helped quite a few customers reporting this issue.

View solution in original post

Motivator

@sgarvin55 -- is this fixed in the new 6.6 release?

0 Karma

Builder

Another user confirming the issue remains in IE on Win7 after clearing browser cache. Chrome seems to be fine.

0 Karma

Engager

Confirmed this fixed all issues we had after upgrading from 6.2.4 to 6.5.0.

0 Karma

Communicator

Thanks.
First time i ever had caching issues with Splunk.

Clearing browser cache solved the issue.

0 Karma

Communicator

Thanks for the answer @sgarvin55 and thanks @polymorphic for confirming the solution.

A colleague of mine who was accessing the same Splunk instance never cleared browser cache. Still it started working for her.

I had cleared it though on my browser.

Still a strange solution if we need to ask all users to clear their browser cache in order to use 6.5 😄

0 Karma

Path Finder

I too have this problem after upgrading from 6.3 to 6.5 on a windows server. All dashboards work fine, search just doesn't populate anything.

Builder

I tried clearing my browser cache in IE and this did not fix it. But then I tried refreshing the page while holding the shift key, and that seemed to fix it for me.

0 Karma

Path Finder

The answer is embarrassingly simple... clear the cache and cookies for the browser you wish to use.

After updating two browsers (IE and edge) it worked. But firefox and chrome were on the latest builds. Simply clearing the cache and cookies worked on them.

0 Karma

Communicator

"Slaps Head" I was in the same boat when going from 6.3 to 6.5 and just now tried clearing the browser cache for the local Spunk domain in Chrome by holding the control key and clicking on refresh wile on the page and it worked like a champ! Good catch @adepasquale

Communicator

Ah more and more folks reporting this as solution.
Thanks again for confirming.

@Splunk should definitely look into it. It's a pain to ask my 200 users to clear cache of their browser.

0 Karma

Splunk Employee
Splunk Employee

The reason for the issue to disappear is because of browser cache clearing. If stale files remain in the cache after the upgrade we hit the issue.

0 Karma

Communicator

Please vote this question then. Might make an impact.

0 Karma

Communicator

Hmm seems to be the search app which gives the problems...
Searches run fine in other apps.

0 Karma

Communicator

Oh yes.. I missed mentioning that.. Infact all dashboard also works fine

0 Karma

Communicator

Yep dashboards had no issues at all on my end as well.

0 Karma

Ultra Champion

A related discussion at dispatch.finalizeRemoteTimeline taking a long time?

It says there -

-- When I run a search in Splunk 6.x, the results come back quickly, but it seems like a lot of time is spent on "Finalize Job". When I look at the search inspector, it shows that a lot of time is spend on "dispatch.finalizeRemoteTimeline".

An answer by @abhijitmishra says -

alt text

0 Karma

Communicator

Now i actually tried to wipe the entire Splunk installation, and install from scratch.
(It is only a test installation)
Still having the same issue.

Could this maybe be an OS issue?
trying to update

No change after update.
Also tried the suggestion from @ddrillic. Still no change.

0 Karma

Communicator

What OS you are running? I see no mention of Win 7 while downloading executable.
Also I already heard it giving issues on Win 7 32 bit machines.

0 Karma