Splunk Search

adhoc searches : canceled remotely or expired

brdr
Contributor

We are starting see issues with users running adhoc searches. While doing adhoc searches we are seeing the error:

Unknown sid
The search job 'name of the search' was cancelled remotely or expired.

I looked at couple of relevant splunk answers pointing to an issue with clock times between search head and indexer. I do not see clock difference between the two.

Is there a search i can run that shows when and how often this cancelled or expired search happens?

As always thank you.

Tags (3)

landen99
Motivator

When your search head processes increased searches, the load slows down its searches. If a longer search takes too long to complete, you will see the error:

Unknown sid
The search job 'name of the search' was cancelled remotely or expired.

Click on "Share" search at the start to save it for 7 days and avoid the error.

Also, if you tell splunk to load an sid that has expired, you will get the same error. This can happen with loadjob, especially if the search job was not saved/shared.

0 Karma

sgontla_splunk
Splunk Employee
Splunk Employee

Default ad-hoc search TTL is 10 minutes. Usually "Unknown sid" error is possible, when a job artifact is removed. Can you give few more details on when exactly you are facing this error? Are you seeing it immediately after running search? OR, after some time, when accessing through the jobs page? is it SHC?

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...