Security

"Unknown sid" Error when doing multiple searches

ibbsplunk
Engager

When I run multiple searches sometimes I get the "Unknown sid" with the orange triangle and exclamation mark under the search bar. When that happens this causes the search to not move forward. This also causes that I cannot pause or stop the search.

1 Solution

obhatti
Explorer

No solution was found but I found a workaround. After starting search, go to Jobs page under Activity from top right hand corner. Then hit Save for the search you are running.

For me, this error usually happens on long searches and this workaround helped.

View solution in original post

0 Karma

deepakmurthy
Explorer

Unknown sid is basically time out, when your search query times out or looses any network connection - it sends displays Unknown Sid.

  • Reduce your data input size of the index, only index for a few months
  • or reduce regular expression transformation in props.conf file.

Inspect the job and see where the time consuming part is. you should be able to identify the cause of it.

Hopefully this would help you.

Also the other solution posted here is also good to review.
http://answers.splunk.com/answers/22969/getting-an-error-banner-http-404-textunknown-sidcode-none-ty...

I didnt have issue with dispatch directory. I had to reduce input size and also reduce my regular expression.

Olli1919
Path Finder

I am also getting this error frequently, on long running foreground searches. Maybe someone can give some insight were on possible root causes? Are there possibly some connections in the background timing out and are being dropped?

0 Karma

somesoni2
SplunkTrust
SplunkTrust
0 Karma

obhatti
Explorer

No solution was found but I found a workaround. After starting search, go to Jobs page under Activity from top right hand corner. Then hit Save for the search you are running.

For me, this error usually happens on long searches and this workaround helped.

0 Karma

deepakmurthy
Explorer

I am having the same issue, was there a solution for this issue.

0 Karma

mrflibbleuk
New Member

Yes I am hitting the same issue with a particularly large query comprised of a few million records. Has anyone found a way to resolve this issue? is it a resource problem?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...