Server error below the search bar

[thippeshaj]

Hi Splunkers,

Need you help to fix the below problem.

We recently migrated our standalone search head to the cluster search head and after that we started seeing server error. After running a search that returns results, if left for just a little bit, the message “Server Error” will pop up below the search bar. I suspect that this is related to the apache proxy ( our authentication method, Apache proxy that is sitting in front of the Splunk webserver) as well as I haven’t seen it happen when using the username/password auth method.

And I have seen similar issue posted but there it was a browser issue but in my case it is not related to browser issue as I have tried on all the browsers and I have faced the similar issues on all.

Thanks in advance,
Thippesh

[ericlarsen]

Did you ever find a resolution for this error?  We're running v7.3.2,  search head cluster, indexer cluster.

It doesn't appear to affect the searches running, but multiple users are getting the "Server Error" message, usually after the job has finalized.

Thanks.

[deepashri_123]

Hi thippeshaj,

Can you look for errors in the splunkd.log
Run the query below:
index=_internal log_level=ERROR and look for the errors.
That might help giving you a better insight.

[thippeshaj]

Hi deepa,
I have tried all the basic troubleshooting, didn't workout.