Splunk Search

Splunk Ad-hoc search getting auto-cancelled randomly

Loves-to-Learn Lots

My Ad-hoc searches getting auto-cancelled randomly.
I am running them with admin privileges.
There's no problem with RAM.
DO not have any limits.conf or authorize.conf under system/local

Labels (1)
0 Karma

Champion

Hi

what you found when you are looking job inspection?

r. Ismo

0 Karma

Loves-to-Learn Lots

Nothing important into inspection search logs .

A single line that differs into successful and unsuccessful run is -

ReducedPhaseExecution status=failed 

0 Karma

Champion

Have you SH or SHC?

Any errors in internal logs?

0 Karma

Loves-to-Learn Lots

Stand-alone SH connected to clustered search peers

0 Karma

Champion

Have you tried to send a job to background? Is it working or not on that way?
Is there FW or some other network equipments between sh and IDX cluster? 

What is latency and realibilty between nodes?

0 Karma

Loves-to-Learn Lots

No such message around error that can expose some hint ..and that’s really strange.

I suspect some kind of limit is getting applied via limits.conf from system/default since we do not have any set under system/local but then there hundreds of default limits and no clue for which one should be looked at ..

0 Karma