Why are searches stuck at "finalizing job" after upgrade to 6.5.0?

[varad_joshi]

I upgraded Splunk on my linux server to 6.5.0 and after that no searches are getting completed. Not even index=_internal

Search job inspector also doesn't load.

All the jobs are getting stuck at 'finalizing job'. Tried bouncing Splunk web services as I was occasionally getting error as "Connection to Splunk server lost."

Any solution please??

[eric_kruse]

Hit Shift-F5 on the search page. Was browser cache for us.

[sgarvin55 · Accepted solution]

search is always "parsing...." after upgrading to 6.5 from 6.3.2 - SPL-129476

This is actually caused by stale files remaining in cache after the upgrade. If you haven't all ready done so, try clearing browser cache and retry the search. This has helped quite a few customers reporting this issue.

[wrangler2x]

@sgarvin55 -- is this fixed in the new 6.6 release?

[_smp_]

Another user confirming the issue remains in IE on Win7 after clearing browser cache. Chrome seems to be fine.

[banspach]

Confirmed this fixed all issues we had after upgrading from 6.2.4 to 6.5.0.

[polymorphic]

Thanks.
First time i ever had caching issues with Splunk.

Clearing browser cache solved the issue.

[varad_joshi]

Thanks for the answer @sgarvin55 and thanks @polymorphic for confirming the solution.

A colleague of mine who was accessing the same Splunk instance never cleared browser cache. Still it started working for her.

I had cleared it though on my browser.

Still a strange solution if we need to ask all users to clear their browser cache in order to use 6.5 😄

[adepasquale]

I too have this problem after upgrading from 6.3 to 6.5 on a windows server. All dashboards work fine, search just doesn't populate anything.

[_smp_]

I tried clearing my browser cache in IE and this did not fix it. But then I tried refreshing the page while holding the shift key, and that seemed to fix it for me.

[adepasquale]

The answer is embarrassingly simple... clear the cache and cookies for the browser you wish to use.

After updating two browsers (IE and edge) it worked. But firefox and chrome were on the latest builds. Simply clearing the cache and cookies worked on them.

[snix]

"Slaps Head" I was in the same boat when going from 6.3 to 6.5 and just now tried clearing the browser cache for the local Spunk domain in Chrome by holding the control key and clicking on refresh wile on the page and it worked like a champ! Good catch @adepasquale

[varad_joshi]

Ah more and more folks reporting this as solution.
Thanks again for confirming.

@Splunk should definitely look into it. It's a pain to ask my 200 users to clear cache of their browser.

[apilgrim_splunk]

The reason for the issue to disappear is because of browser cache clearing. If stale files remain in the cache after the upgrade we hit the issue.

[varad_joshi]

Please vote this question then. Might make an impact.

[polymorphic]

Hmm seems to be the search app which gives the problems...
Searches run fine in other apps.

[varad_joshi]

Oh yes.. I missed mentioning that.. Infact all dashboard also works fine

[snix]

Yep dashboards had no issues at all on my end as well.

[ddrillic]

A related discussion at dispatch.finalizeRemoteTimeline taking a long time?

It says there -

-- When I run a search in Splunk 6.x, the results come back quickly, but it seems like a lot of time is spent on "Finalize Job". When I look at the search inspector, it shows that a lot of time is spend on "dispatch.finalizeRemoteTimeline".

An answer by @abhijitmishra says -

[polymorphic]

Now i actually tried to wipe the entire Splunk installation, and install from scratch.
(It is only a test installation)
Still having the same issue.

Could this maybe be an OS issue?
trying to update

No change after update.
Also tried the suggestion from @ddrillic. Still no change.

[varad_joshi]

What OS you are running? I see no mention of Win 7 while downloading executable.
Also I already heard it giving issues on Win 7 32 bit machines.