Reporting

Splunk pivot screen base search is paused

Arun_N_00007
New Member

Hello All,

When i open my datamodel in pivote screen 2 searches are dispatched,

One is base search which searches for all time and another one is tscollect runs on top of it to do aggregation/filters.

The base search is getting paused within seconds witout any reason. DUe to this my search is not returning any results. If i open the same report in open in search mode it works fine (Then it executes with pivot command.)

Please let me know why it happens and how to resolve this?

Regards,
Arun N

0 Karma

Arun_N_00007
New Member

Whenever i load the data model am getting below error message.
This search did not successfully execute. Any results returned from this job are not consistent and should not be used.

And in search log am getting entries like below,

But i never applied pause.. 😞

03-25-2019 13:01:29.791 INFO ReducePhaseExecutor - ReducePhaseExecutor=1 action=PAUSE
03-25-2019 13:01:29.791 INFO DispatchExecutor - User applied action=PAUSE while status=1
03-25-2019 13:01:29.892 INFO ReducePhaseExecutor - ReducePhaseExecutor=1 action=PAUSE
03-25-2019 13:01:29.892 INFO DispatchExecutor - User applied action=PAUSE while status=1
03-25-2019 13:01:29.998 INFO ReducePhaseExecutor - ReducePhaseExecutor=1 action=PAUSE
03-25-2019 13:01:29.998 INFO DispatchExecutor - User applied action=PAUSE while status=1
03-25-2019 13:01:30.100 INFO ReducePhaseExecutor - ReducePhaseExecutor=1 action=PAUSE
03-25-2019 13:01:30.100 INFO DispatchExecutor - User applied action=PAUSE while status=1
03-25-2019 13:01:30.189 INFO ReducePhaseExecutor - ReducePhaseExecutor=1 action=PAUSE
03-25-2019 13:01:30.189 INFO DispatchExecutor - User applied action=PAUSE while status=1
03-25-2019 13:01:30.299 INFO ReducePhaseExecutor - ReducePhaseExecutor=1 action=PAUSE
03-25-2019 13:01:30.299 INFO DispatchExecutor - User applied action=PAUSE while status=1
03-25-2019 13:01:30.399 INFO ReducePhaseExecutor - ReducePhaseExecutor=1 action=PAUSE
03-25-2019 13:01:30.399 INFO DispatchExecutor - User applied action=PAUSE while status=1
03-25-2019 13:01:30.491 INFO ReducePhaseExecutor - ReducePhaseExecutor=1 action=PAUSE
03-25-2019 13:01:30.491 INFO DispatchExecutor - User applied action=PAUSE while status=1
03-25-2019 13:01:30.589 INFO ReducePhaseExecutor - ReducePhaseExecutor=1 action=PAUSE
03-25-2019 13:01:30.589 INFO DispatchExecutor - User applied action=PAUSE while status=1
03-25-2019 13:01:30.693 INFO ReducePhaseExecutor - ReducePhaseExecutor=1 action=PAUSE
03-25-2019 13:01:30.693 INFO DispatchExecutor - User applied action=PAUSE while status=1
03-25-2019 13:01:30.787 INFO ReducePhaseExecutor - ReducePhaseExecutor=1 action=PAUSE
03-25-2019 13:01:30.787 INFO DispatchExecutor - User applied action=PAUSE while status=1
03-25-2019 13:01:30.888 INFO ReducePhaseExecutor - ReducePhaseExecutor=1 action=PAUSE
03-25-2019 13:01:30.888 INFO DispatchExecutor - User applied action=PAUSE while status=1

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...