Splunk Search
Highlighted

Why is the background search failed with an error "search was canceled"?

Builder

We are running Splunk v 7.0.1.
One of our splunk users sent a search to the background and received the following email.
What could have caused the background search to be cancelled as it was not done manually.
Thank you!
The search that you sent to the background has completed!
Status: ERROR (search state is FAILED)
LInk:
Search:
Results: 0
Events: 38
Start time: 2018-03-20 11:12:33 EDT
Run time: 2888.806535079

The search has generated the following messages:
ERROR MESSAGES:
Search was canceled
0 Karma
Highlighted

Re: Why is the background search failed with an error "search was canceled"?

Influencer

Can you check the _audit index for the search to give us more insight?

0 Karma
Highlighted

Re: Why is the background search failed with an error "search was canceled"?

Builder

@tiagofbmm in _audit I found something like this : "Audit:[timestamp=03-20-2018 11:12:33.191, user=, action=quota,searchid=usernameusernamec3BsdW5rX2lzZWNhsearch21521558753.140417E1EDCF3F-8C8F-4C77-A662-09D345FAC644, elapsedms=17, cachesize=4027][n/a] "

0 Karma
Highlighted

Re: Why is the background search failed with an error "search was canceled"?

Influencer

Was Splunk restarted when the search was running?

0 Karma
Highlighted

Re: Why is the background search failed with an error "search was canceled"?

Builder

@strive -splunk wasn't restarted

0 Karma