adhoc searches : canceled remotely or expired

[brdr]

We are starting see issues with users running adhoc searches. While doing adhoc searches we are seeing the error:

Unknown sid
The search job 'name of the search' was cancelled remotely or expired.

I looked at couple of relevant splunk answers pointing to an issue with clock times between search head and indexer. I do not see clock difference between the two.

Is there a search i can run that shows when and how often this cancelled or expired search happens?

As always thank you.

[sgontla_splunk]

Default ad-hoc search TTL is 10 minutes. Usually "Unknown sid" error is possible, when a job artifact is removed. Can you give few more details on when exactly you are facing this error? Are you seeing it immediately after running search? OR, after some time, when accessing through the jobs page? is it SHC?

[landen99]

When your search head processes increased searches, the load slows down its searches. If a longer search takes too long to complete, you will see the error:

Unknown sid
The search job 'name of the search' was cancelled remotely or expired.

Click on "Share" search at the start to save it for 7 days and avoid the error.

Also, if you tell splunk to load an sid that has expired, you will get the same error. This can happen with loadjob, especially if the search job was not saved/shared.