Splunk Search
Highlighted

adhoc searches : canceled remotely or expired

Contributor

We are starting see issues with users running adhoc searches. While doing adhoc searches we are seeing the error:

Unknown sid
The search job 'name of the search' was cancelled remotely or expired.

I looked at couple of relevant splunk answers pointing to an issue with clock times between search head and indexer. I do not see clock difference between the two.

Is there a search i can run that shows when and how often this cancelled or expired search happens?

As always thank you.

Tags (3)
Highlighted

Re: adhoc searches : canceled remotely or expired

Default ad-hoc search TTL is 10 minutes. Usually "Unknown sid" error is possible, when a job artifact is removed. Can you give few more details on when exactly you are facing this error? Are you seeing it immediately after running search? OR, after some time, when accessing through the jobs page? is it SHC?

0 Karma
Highlighted

Re: adhoc searches : canceled remotely or expired

Motivator

When your search head processes increased searches, the load slows down its searches. If a longer search takes too long to complete, you will see the error:

Unknown sid
The search job 'name of the search' was cancelled remotely or expired.

Click on "Share" search at the start to save it for 7 days and avoid the error.

Also, if you tell splunk to load an sid that has expired, you will get the same error. This can happen with loadjob, especially if the search job was not saved/shared.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.