Splunk Search

[EventsViewer module] Cannot access search data; job <job_id> is a zombie and is no longer with us

Champion

I recently restarted Splunk and found that a bunch of jobs return this error when I click on the jobs link. What happened to those jobs?

Tags (3)
1 Solution

Champion

Splunk's current behavior is that it does not keep track of paused or backgrounded searches after a restart.

View solution in original post

Champion

Splunk's current behavior is that it does not keep track of paused or backgrounded searches after a restart.

View solution in original post

Champion

Currently, all child processes die when splunkd goes down. So, no searches will surviv a restart. Please file an ER and provide your usecase if you need this in a future release.

0 Karma

Splunk Employee
Splunk Employee

What about jobs that were active? Do any searches survive restart?

0 Karma

Champion

And I talk to myself.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!