Splunk Search

What is causing my dashboards to throw error "The search job terminated unexpectedly" when choosing a large time range?

DavidHourani
Super Champion

Hello,

I am having a problem when loading my dashboards for long time ranges.

The error "The search job terminated unexpectedly." is appearing after a minute or so (when the views are at about 40-50%). The message is sort of random. Sometimes it appears on all views, sometimes some, sometimes none.

My searches are quite simple "index=..." with 2 lookups. If I run the dashboard for a smaller time range, I don't have a problem. It's only for large time ranges.

Any idea what I can do to fix this ?

Best regards,
David

1 Solution

DavidHourani
Super Champion

The searches I was using weren't very optimized since I was using "| dedup _raw" right after "index=Cars" Had to apply my filters before using the dedup and that made it a lot faster and now searches are not causing anymore errors.

View solution in original post

DavidHourani
Super Champion

The searches I was using weren't very optimized since I was using "| dedup _raw" right after "index=Cars" Had to apply my filters before using the dedup and that made it a lot faster and now searches are not causing anymore errors.

markthompson
Builder

You say this is happening on the dashboard, does it happen when you use the search functionality?

If so, is there a certain date which causes it to error?

0 Karma

DavidHourani
Super Champion

No it does not happen when I run a search. It's only happening on the dashboard..

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...