Splunk Search
Highlighted

[EventsViewer module] Cannot access search data; job <job_id> is a zombie and is no longer with us

Champion

I recently restarted Splunk and found that a bunch of jobs return this error when I click on the jobs link. What happened to those jobs?

Tags (3)
Highlighted

Re: [EventsViewer module] Cannot access search data; job <job_id> is a zombie and is no longer with us

Champion

Splunk's current behavior is that it does not keep track of paused or backgrounded searches after a restart.

View solution in original post

Highlighted

Re: [EventsViewer module] Cannot access search data; job <job_id> is a zombie and is no longer with us

Champion

And I talk to myself.

Highlighted

Re: [EventsViewer module] Cannot access search data; job <job_id> is a zombie and is no longer with us

Splunk Employee
Splunk Employee

What about jobs that were active? Do any searches survive restart?

0 Karma
Highlighted

Re: [EventsViewer module] Cannot access search data; job <job_id> is a zombie and is no longer with us

Champion

Currently, all child processes die when splunkd goes down. So, no searches will surviv a restart. Please file an ER and provide your usecase if you need this in a future release.

0 Karma