Splunk Search

Error message above search bar

bsantosh
New Member

Hi All,

When I am executing a search query something like "index=index1", I am getting the below error message above my search bar. I am still above fetch the results.

I have set the search mode to Verbose mode.

"! Some events cannot be displayed because they cannot be fetched from the remote search peer(s). This is likely caused by the natural expiration of the related remote search jobs. To view the omitted events, run the search again."

thanks,
Santosh

Tags (1)
0 Karma

abeeber_3
Explorer

Have you checked your disk capacity on your SH?

I had a situation where a user reported a similar problem with one of his searches.

At the same time another user had submitted a number of searches that got stuck in the dispatch folder and ended up maxing out the disk space on the Search Server.

Once cleared, the other user's search ran as expected with out generated the error above.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you checked the connectivity to your indexers?

---
If this reply helps you, Karma would be appreciated.
0 Karma

bsantosh
New Member

Hi Richgalloway, thanks for your reply. I checked the connectivity with indexers and they look good.
Sorry for late reply.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...