We are running Splunk v 7.0.1.
One of our splunk users sent a search to the background and received the following email.
What could have caused the background search to be cancelled as it was not done manually.
Thank you!
The search that you sent to the background has completed!
Status: ERROR (search state is FAILED)
LInk:
Search:
Results: 0
Events: 38
Start time: 2018-03-20 11:12:33 EDT
Run time: 2888.806535079
The search has generated the following messages:
ERROR MESSAGES:
Search was canceled
Was Splunk restarted when the search was running?
@strive -splunk wasn't restarted
Can you check the _audit index for the search to give us more insight?
@tiagofbmm in _audit I found something like this : "Audit:[timestamp=03-20-2018 11:12:33.191, user=, action=quota,search_id=user_name_user_name_c3BsdW5rX2lzZWNh_search2_1521558753.140417_E1EDCF3F-8C8F-4C77-A662-09D345FAC644, elapsed_ms=17, cache_size=4027][n/a] "