I am running scheduled search for last 24 hours.It never completes and show status as "completed" and Job inspector says
This search has encountered a fatal error and has been marked as zombied.
What is the reason for this.
I had this exact symptom and managed to fix it by disabling Transparent Huge Pages (THP) on a server.
Basically when server is pressed on memory or search is pushing some limits - THP comes into play in a weird ways causing silent failures.
See more here:
https://answers.splunk.com/answers/188875/how-do-i-disable-transparent-huge-pages-thp-and-co.html
Thankyou. Appreciate it.