We are running Splunk v 7.0.1.
One of our splunk users sent a search to the background and received the following email.
What could have caused the background search to be cancelled as it was not done manually.
The search that you sent to the background has completed!
Status: ERROR (search state is FAILED)
Start time: 2018-03-20 11:12:33 EDT
Run time: 2888.806535079
The search has generated the following messages: ERROR MESSAGES: Search was canceled
@tiagofbmm in _audit I found something like this : "Audit:[timestamp=03-20-2018 11:12:33.191, user=, action=quota,searchid=usernameusernamec3BsdW5rX2lzZWNhsearch21521558753.140417E1EDCF3F-8C8F-4C77-A662-09D345FAC644, elapsedms=17, cachesize=4027][n/a] "