Randomly problems when execute a search

[splunk_soc360]

Hi,

Since a few months I have random problems when I try to execute a search that works correctly.
The problem is that sometimes the job of the search returns the following exception:

"""
X errors occurred while the search was executing. Therefore, search results might be incomplete.
Dispatch Command: Unknown error for indexer: my_search_head_0X. Search Results might be incomplete! If this occurs frequently, please check on the peer.
"""

This error show up problems in each Search Head that I have.
How I said this is random because if I try to execute again the same query after the error it shows me the results.

Anybody can help me to fix this or understand why is happening this.

Thanks.

[ololdach]

Hi,

you need to find the root cause for the error. On the splunk UI, dropdown "Job" and select "Inspect Job" to open the job inspector of a failed query. In the Job inspector window, look for the "search.log" link and click it. In the log, search for the words "WARN" or "ERROR"

Once you know the root cause for the problem, we could probably help you to avoid it in the future.

Hope it helps,
Oliver