Splunk Search

adhoc searches : canceled remotely or expired

brdr
Contributor

We are starting see issues with users running adhoc searches. While doing adhoc searches we are seeing the error:

Unknown sid
The search job 'name of the search' was cancelled remotely or expired.

I looked at couple of relevant splunk answers pointing to an issue with clock times between search head and indexer. I do not see clock difference between the two.

Is there a search i can run that shows when and how often this cancelled or expired search happens?

As always thank you.

Tags (3)

landen99
Motivator

When your search head processes increased searches, the load slows down its searches. If a longer search takes too long to complete, you will see the error:

Unknown sid
The search job 'name of the search' was cancelled remotely or expired.

Click on "Share" search at the start to save it for 7 days and avoid the error.

Also, if you tell splunk to load an sid that has expired, you will get the same error. This can happen with loadjob, especially if the search job was not saved/shared.

0 Karma

sgontla_splunk
Splunk Employee
Splunk Employee

Default ad-hoc search TTL is 10 minutes. Usually "Unknown sid" error is possible, when a job artifact is removed. Can you give few more details on when exactly you are facing this error? Are you seeing it immediately after running search? OR, after some time, when accessing through the jobs page? is it SHC?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...