Splunk Search

Search auto-canceled in seachhead cluster behind Kong

bknumb
New Member

Hi everyone,

I'm currently facing an issue in search head cluster. when I search an index with long duration (e.g last 3 days) it shows error "Search auto-canceled" in search.log.

Our search head cluster has three nodes and behind a Kong API gateway. On Kong we've already configured sticky session (hash on cookies named: splunkd_8000)

I tried to test three cases below:

- search directly on one node of the cluster (traffic does not go through Kong) --> OK

- disable two nodes and search on domain (that means traffic go through Kong) --> OK

- search on domain with three nodes cluster --> show above error

please see below picture if above description not clear enough. Anyone has idea to resolve this issue? Thank you very much!

Splunk-error.png

 

Labels (1)
0 Karma