Reporting

This search has encountered a fatal error and has been marked as zombied. Splunk

disha
Contributor

I am running scheduled search for last 24 hours.It never completes and show status as "completed" and Job inspector says
This search has encountered a fatal error and has been marked as zombied.
What is the reason for this.

Tags (1)
0 Karma
1 Solution

ChrisG
Splunk Employee
Splunk Employee

See this previous Answers posting (found by searching for zombie on this site).

View solution in original post

gesman_splunk
Splunk Employee
Splunk Employee

I had this exact symptom and managed to fix it by disabling Transparent Huge Pages (THP) on a server.

Basically when server is pressed on memory or search is pushing some limits - THP comes into play in a weird ways causing silent failures.

See more here:
https://answers.splunk.com/answers/188875/how-do-i-disable-transparent-huge-pages-thp-and-co.html

0 Karma

ChrisG
Splunk Employee
Splunk Employee

See this previous Answers posting (found by searching for zombie on this site).

View solution in original post

disha
Contributor

Thankyou. Appreciate it.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!