Installation

Why are searches stuck at "finalizing job" after upgrade to 6.5.0?

varad_joshi
Communicator

I upgraded Splunk on my linux server to 6.5.0 and after that no searches are getting completed. Not even index=_internal

Search job inspector also doesn't load.

All the jobs are getting stuck at 'finalizing job'. Tried bouncing Splunk web services as I was occasionally getting error as "Connection to Splunk server lost."

Any solution please??

Labels (2)
1 Solution

sgarvin55
Splunk Employee
Splunk Employee

search is always "parsing...." after upgrading to 6.5 from 6.3.2 - SPL-129476

This is actually caused by stale files remaining in cache after the upgrade. If you haven't all ready done so, try clearing browser cache and retry the search. This has helped quite a few customers reporting this issue.

View solution in original post

eric_kruse
Engager

Hit Shift-F5 on the search page. Was browser cache for us.

0 Karma

sgarvin55
Splunk Employee
Splunk Employee

search is always "parsing...." after upgrading to 6.5 from 6.3.2 - SPL-129476

This is actually caused by stale files remaining in cache after the upgrade. If you haven't all ready done so, try clearing browser cache and retry the search. This has helped quite a few customers reporting this issue.

wrangler2x
Motivator

@sgarvin55 -- is this fixed in the new 6.6 release?

0 Karma

_smp_
Builder

Another user confirming the issue remains in IE on Win7 after clearing browser cache. Chrome seems to be fine.

0 Karma

banspach
Engager

Confirmed this fixed all issues we had after upgrading from 6.2.4 to 6.5.0.

0 Karma

polymorphic
Communicator

Thanks.
First time i ever had caching issues with Splunk.

Clearing browser cache solved the issue.

0 Karma

varad_joshi
Communicator

Thanks for the answer @sgarvin55 and thanks @polymorphic for confirming the solution.

A colleague of mine who was accessing the same Splunk instance never cleared browser cache. Still it started working for her.

I had cleared it though on my browser.

Still a strange solution if we need to ask all users to clear their browser cache in order to use 6.5 😄

0 Karma

adepasquale
Path Finder

I too have this problem after upgrading from 6.3 to 6.5 on a windows server. All dashboards work fine, search just doesn't populate anything.

_smp_
Builder

I tried clearing my browser cache in IE and this did not fix it. But then I tried refreshing the page while holding the shift key, and that seemed to fix it for me.

0 Karma

adepasquale
Path Finder

The answer is embarrassingly simple... clear the cache and cookies for the browser you wish to use.

After updating two browsers (IE and edge) it worked. But firefox and chrome were on the latest builds. Simply clearing the cache and cookies worked on them.

0 Karma

snix
Communicator

"Slaps Head" I was in the same boat when going from 6.3 to 6.5 and just now tried clearing the browser cache for the local Spunk domain in Chrome by holding the control key and clicking on refresh wile on the page and it worked like a champ! Good catch @adepasquale

varad_joshi
Communicator

Ah more and more folks reporting this as solution.
Thanks again for confirming.

@Splunk should definitely look into it. It's a pain to ask my 200 users to clear cache of their browser.

0 Karma

apilgrim_splunk
Splunk Employee
Splunk Employee

The reason for the issue to disappear is because of browser cache clearing. If stale files remain in the cache after the upgrade we hit the issue.

0 Karma

varad_joshi
Communicator

Please vote this question then. Might make an impact.

0 Karma

polymorphic
Communicator

Hmm seems to be the search app which gives the problems...
Searches run fine in other apps.

0 Karma

varad_joshi
Communicator

Oh yes.. I missed mentioning that.. Infact all dashboard also works fine

0 Karma

snix
Communicator

Yep dashboards had no issues at all on my end as well.

0 Karma

ddrillic
Ultra Champion

A related discussion at dispatch.finalizeRemoteTimeline taking a long time?

It says there -

-- When I run a search in Splunk 6.x, the results come back quickly, but it seems like a lot of time is spent on "Finalize Job". When I look at the search inspector, it shows that a lot of time is spend on "dispatch.finalizeRemoteTimeline".

An answer by @abhijitmishra says -

alt text

0 Karma

polymorphic
Communicator

Now i actually tried to wipe the entire Splunk installation, and install from scratch.
(It is only a test installation)
Still having the same issue.

Could this maybe be an OS issue?
trying to update

No change after update.
Also tried the suggestion from @ddrillic. Still no change.

0 Karma

varad_joshi
Communicator

What OS you are running? I see no mention of Win 7 while downloading executable.
Also I already heard it giving issues on Win 7 32 bit machines.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...