Every 15 min we get the following error: "Unknown error for peer . Search Results might be incomplete. If this occurs frequently, please check on the peer."

[stefan1988]

At every hour, 15, 30 and 45 I'm getting the following error for any search:
"Unknown error for peer . Search Results might be incomplete. If this occurs frequently, please check on the peer."

The error appears on every search head exactly on the timestamps mentioned above. Also Splunk does not show any events.

What should I look for to find the root cause?

[jkat54]

Sounds like you have a scheduled search that runs every 15 minutes and it's "breaking" your indexer(s).

You can use btool to show all the saved searches and their schedule:

$SPLUNK_HOME/bin/splunk btool savedsearches list --debug