Hi everyone,
I'm currently facing an issue in search head cluster. when I search an index with long duration (e.g last 3 days) it shows error "Search auto-canceled" in search.log.
Our search head cluster has three nodes and behind a Kong API gateway. On Kong we've already configured sticky session (hash on cookies named: splunkd_8000)
I tried to test three cases below:
- search directly on one node of the cluster (traffic does not go through Kong) --> OK
- disable two nodes and search on domain (that means traffic go through Kong) --> OK
- search on domain with three nodes cluster --> show above error
please see below picture if above description not clear enough. Anyone has idea to resolve this issue? Thank you very much!
