Dashboards & Visualizations

Dashboard "Search was cancelled"

mythili
Explorer

In our dashboard, a user reported that she got "Search was cancelled" message when she used it. I came to know that multiple searches were run concurrently. Hence, it could have been cancelled.
But when I tried to reproduce this issue, the searches kept getting queued and ran but was never delayed. 

What are the scenario when a search is queued vs when it is cancelled?

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

The search might get cancelled if - for example - your user exceeds resource limits. If you are trying to reproduce the issue with user with another role having differently set limits (or not having limits at all) you might not hit the same restrictions.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mythili,

there's a timeout for a search execution.

In addition you probably are an andmin and the user has different search settings.

So you could hint to your colleague to run less contemporary searches.

I don't hint to give an higher number of executable searches to that role because you could have performance issues.

You culd aso hint to your colleague to run this search in background, in this way he/she is secure that the search doesn't go in timeout.

ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...