I am newbie and just installed Splunk today.
i am seeing the same issue:
ERROR SearchOrchestrator - Phase_1 failed due to : DAG Execution Exception: Search has been cancelled
01-31-2019 15:44:36.590 INFO ReducePhaseExecutor - ReducePhaseExecutor=1 action=CANCEL
And understand what you mean, but have no clue what eat steps to do to fix it.
On the jobs endpoint, there's an auto_cancel option you can use to control this timeout. Setting to 0 should disable it. You can check the settings for the job in a file called runtime.csv in the dispatch directory.
If you are facing this issue with any of the saved searches, then configure the saved search for archiving with "dispatch.auto_cancel = 0"
successfully run the job without auto canceled.
Can you elaborate pls?
... View more