Security

"Unknown sid" Error when doing multiple searches

ibbsplunk
Engager

When I run multiple searches sometimes I get the "Unknown sid" with the orange triangle and exclamation mark under the search bar. When that happens this causes the search to not move forward. This also causes that I cannot pause or stop the search.

1 Solution

obhatti
Explorer

No solution was found but I found a workaround. After starting search, go to Jobs page under Activity from top right hand corner. Then hit Save for the search you are running.

For me, this error usually happens on long searches and this workaround helped.

View solution in original post

0 Karma

deepakmurthy
Explorer

Unknown sid is basically time out, when your search query times out or looses any network connection - it sends displays Unknown Sid.

  • Reduce your data input size of the index, only index for a few months
  • or reduce regular expression transformation in props.conf file.

Inspect the job and see where the time consuming part is. you should be able to identify the cause of it.

Hopefully this would help you.

Also the other solution posted here is also good to review.
http://answers.splunk.com/answers/22969/getting-an-error-banner-http-404-textunknown-sidcode-none-ty...

I didnt have issue with dispatch directory. I had to reduce input size and also reduce my regular expression.

Olli1919
Path Finder

I am also getting this error frequently, on long running foreground searches. Maybe someone can give some insight were on possible root causes? Are there possibly some connections in the background timing out and are being dropped?

0 Karma

somesoni2
Revered Legend
0 Karma

obhatti
Explorer

No solution was found but I found a workaround. After starting search, go to Jobs page under Activity from top right hand corner. Then hit Save for the search you are running.

For me, this error usually happens on long searches and this workaround helped.

0 Karma

deepakmurthy
Explorer

I am having the same issue, was there a solution for this issue.

0 Karma

mrflibbleuk
New Member

Yes I am hitting the same issue with a particularly large query comprised of a few million records. Has anyone found a way to resolve this issue? is it a resource problem?

0 Karma
Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...