Splunk Ad-hoc search getting auto-cancelled randomly

[sagaraverma]

My Ad-hoc searches getting auto-cancelled randomly.
I am running them with admin privileges.
There's no problem with RAM.
DO not have any limits.conf or authorize.conf under system/local

[isoutamo]

Hi

what you found when you are looking job inspection?

r. Ismo

[sagaraverma]

Nothing important into inspection search logs .

A single line that differs into successful and unsuccessful run is -

ReducedPhaseExecution status=failed 

[isoutamo]

Have you SH or SHC?

Any errors in internal logs?

[sagaraverma]

Stand-alone SH connected to clustered search peers

[isoutamo]

Have you tried to send a job to background? Is it working or not on that way?
Is there FW or some other network equipments between sh and IDX cluster? 

What is latency and realibilty between nodes?

[sagaraverma]

No such message around error that can expose some hint ..and that’s really strange.

I suspect some kind of limit is getting applied via limits.conf from system/default since we do not have any set under system/local but then there hundreds of default limits and no clue for which one should be looked at ..