Why is the background search failed with an error "search was canceled"?

[mlevsh]

We are running Splunk v 7.0.1.
One of our splunk users sent a search to the background and received the following email.
What could have caused the background search to be cancelled as it was not done manually.
Thank you!
The search that you sent to the background has completed!
Status: ERROR (search state is FAILED)
LInk:
Search:

Results: 0
Events: 38
Start time: 2018-03-20 11:12:33 EDT
Run time: 2888.806535079

The search has generated the following messages:
ERROR MESSAGES:
Search was canceled

[strive]

Was Splunk restarted when the search was running?

[mlevsh]

@strive -splunk wasn't restarted

[tiagofbmm]

Can you check the _audit index for the search to give us more insight?

[mlevsh]

@tiagofbmm in _audit I found something like this : "Audit:[timestamp=03-20-2018 11:12:33.191, user=, action=quota,search_id=user_name_user_name_c3BsdW5rX2lzZWNh_search2_1521558753.140417_E1EDCF3F-8C8F-4C77-A662-09D345FAC644, elapsed_ms=17, cache_size=4027][n/a] "