This search has encountered a fatal error and has been marked as zombied. Splunk

[disha]

I am running scheduled search for last 24 hours.It never completes and show status as "completed" and Job inspector says
This search has encountered a fatal error and has been marked as zombied.
What is the reason for this.

[gesman_splunk]

I had this exact symptom and managed to fix it by disabling Transparent Huge Pages (THP) on a server.

Basically when server is pressed on memory or search is pushing some limits - THP comes into play in a weird ways causing silent failures.

See more here:
https://answers.splunk.com/answers/188875/how-do-i-disable-transparent-huge-pages-thp-and-co.html

[ChrisG · Accepted solution]

See this previous Answers posting (found by searching for zombie on this site).

[disha]

Thankyou. Appreciate it.