How resolve the error "Search auto-canceled and DAG execution error"?

[smaheshwarappaa]

Hi Team,

When i m searching the  switch logs for last 7 days, i m gettting the error " Search auto-canceled and DAG execution error ". able to get last 15 or 60 mins logs, could you please suggest how can i resolve this issue. i m using 8.1.3 splunk enterprise version.

Thanks

Sridevi M

[burwell]

Looks like Splunk offered a solution starting in 8.1.7 and 8.2.4

https://docs.splunk.com/Documentation/Splunk/latest/ReleaseNotes/Knownissues
 

Searches are cancelled or time out when the user leaves the browser window or switches tabs.

Workaround:
In Splunk Enterprise 8.1.7, 8.2.4, and higher change the job_default_auto_cancel setting in $SPLUNK_HOME/etc/system/local/web.conf from the default value of 30 to 62.

Details
This issue is caused by power saving settings in recent browser versions, where Javascript timers may be throttled. The user typically sees the following message in the search window on foreground searches:

DAG Execution Exception: Search has been cancelled
Search auto-canceled
The search job has failed due to an error. You may be able to view the job in the Job Inspector

---

[Roy_9]

Please look at the  Advanced edit section of your saved search and make the below changes

dispatch.auto_cancel = <integer>
* Specifies the amount of inactive time, in seconds, after which the job
  is automatically canceled.
* 0 means to never auto-cancel the job.
* Default: 0  

dispatch.max_time = <integer> *

The maximum amount of time, in seconds, before finalizing the search. *

Default: 0

This should help fix the issue and this usually occurs when your SH uses all of the RAM.

If you are on Splunk cloud, also try to increase the disk space limit for your role

[jgallien]

Autocancel is set to 0 already.  I've been down that path.  The search ends in a couple of seconds.  Any hints on any resource limits or splunk limits that might be able to be tweaked?  I'm headed down that path since I've been looking into this for over a week with no progress.

[Roy_9]

if you are on splunk cloud, Can you give a try by changing the settings of the role by going through role -edit- resources- role search time window limit to infinite and disk space limit to 10000 MB and give a try.

[jgallien]

It is not cloud, but Enterprise on-prem.  Interestingly, I was able to run the same searches on the CLI using a max event return of 50k and got results back no problem.  Wondering why the GUI would autocancel if the CLI can get the dispatch results no problem.

[jgallien]

I'm having the same problem, not making any headway.  Have you checked your search.log in the inspector window?  Mine is showing a collector failure to write (before it calls the CANCEL), but can't figure out why.  Looking at the $SPLUNKHOME/var/log/*.log may be helpful.  I can see some errors there, but none have really led me to the answer.  It's almost like it is hitting a search limit and stopping.