"Unknown sid" Error when doing multiple searches

[ibbsplunk]

When I run multiple searches sometimes I get the "Unknown sid" with the orange triangle and exclamation mark under the search bar. When that happens this causes the search to not move forward. This also causes that I cannot pause or stop the search.

[deepakmurthy]

Unknown sid is basically time out, when your search query times out or looses any network connection - it sends displays Unknown Sid.

• Reduce your data input size of the index, only index for a few months
• or reduce regular expression transformation in props.conf file.

Inspect the job and see where the time consuming part is. you should be able to identify the cause of it.

Hopefully this would help you.

Also the other solution posted here is also good to review.
http://answers.splunk.com/answers/22969/getting-an-error-banner-http-404-textunknown-sidcode-none-ty...

I didnt have issue with dispatch directory. I had to reduce input size and also reduce my regular expression.

[Olli1919]

I am also getting this error frequently, on long running foreground searches. Maybe someone can give some insight were on possible root causes? Are there possibly some connections in the background timing out and are being dropped?

[somesoni2]

Is your error similar to this?
http://answers.splunk.com/answers/22969/getting-an-error-banner-http-404-textunknown-sidcode-none-ty...

[obhatti · Accepted solution]

No solution was found but I found a workaround. After starting search, go to Jobs page under Activity from top right hand corner. Then hit Save for the search you are running.

For me, this error usually happens on long searches and this workaround helped.

[deepakmurthy]

I am having the same issue, was there a solution for this issue.

[mrflibbleuk]

Yes I am hitting the same issue with a particularly large query comprised of a few million records. Has anyone found a way to resolve this issue? is it a resource problem?