Hi everyone, I'm currently facing an issue in search head cluster. when I search an index with long duration (e.g last 3 days) it shows error "Search auto-canceled" in search.log. Our search head cluster has three nodes and behind a Kong API gateway. On Kong we've already configured sticky session (hash on cookies named: splunkd_8000) I tried to test three cases below: - search directly on one node of the cluster (traffic does not go through Kong) --> OK - disable two nodes and search on domain (that means traffic go through Kong) --> OK - search on domain with three nodes cluster --> show above error please see below picture if above description not clear enough. Anyone has idea to resolve this issue? Thank you very much!
... View more