Splunk Search

Error message above search bar

bsantosh
New Member

Hi All,

When I am executing a search query something like "index=index1", I am getting the below error message above my search bar. I am still above fetch the results.

I have set the search mode to Verbose mode.

"! Some events cannot be displayed because they cannot be fetched from the remote search peer(s). This is likely caused by the natural expiration of the related remote search jobs. To view the omitted events, run the search again."

thanks,
Santosh

Tags (1)
0 Karma

abeeber_3
Explorer

Have you checked your disk capacity on your SH?

I had a situation where a user reported a similar problem with one of his searches.

At the same time another user had submitted a number of searches that got stuck in the dispatch folder and ended up maxing out the disk space on the Search Server.

Once cleared, the other user's search ran as expected with out generated the error above.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you checked the connectivity to your indexers?

---
If this reply helps you, Karma would be appreciated.
0 Karma

bsantosh
New Member

Hi Richgalloway, thanks for your reply. I checked the connectivity with indexers and they look good.
Sorry for late reply.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...