Splunk Search

adhoc searches : canceled remotely or expired

brdr
Contributor

We are starting see issues with users running adhoc searches. While doing adhoc searches we are seeing the error:

Unknown sid
The search job 'name of the search' was cancelled remotely or expired.

I looked at couple of relevant splunk answers pointing to an issue with clock times between search head and indexer. I do not see clock difference between the two.

Is there a search i can run that shows when and how often this cancelled or expired search happens?

As always thank you.

Tags (3)

landen99
Motivator

When your search head processes increased searches, the load slows down its searches. If a longer search takes too long to complete, you will see the error:

Unknown sid
The search job 'name of the search' was cancelled remotely or expired.

Click on "Share" search at the start to save it for 7 days and avoid the error.

Also, if you tell splunk to load an sid that has expired, you will get the same error. This can happen with loadjob, especially if the search job was not saved/shared.

0 Karma

sgontla_splunk
Splunk Employee
Splunk Employee

Default ad-hoc search TTL is 10 minutes. Usually "Unknown sid" error is possible, when a job artifact is removed. Can you give few more details on when exactly you are facing this error? Are you seeing it immediately after running search? OR, after some time, when accessing through the jobs page? is it SHC?

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...