[EventsViewer module] Cannot access search data; job <job_id> is a zombie and is no longer with us

[the_wolverine]

I recently restarted Splunk and found that a bunch of jobs return this error when I click on the jobs link. What happened to those jobs?

[the_wolverine · Accepted solution]

Splunk's current behavior is that it does not keep track of paused or backgrounded searches after a restart.

[the_wolverine]

Currently, all child processes die when splunkd goes down. So, no searches will surviv a restart. Please file an ER and provide your usecase if you need this in a future release.

[Dan]

What about jobs that were active? Do any searches survive restart?

[the_wolverine]

And I talk to myself.