Hi,
We are using Splunk Enterprise 7.0.1. Search head cluster and indexing cluster.
Our users, including splunk administrators, are getting "Server error" from time to time. Usually it goes away by itself after a while, but it's impossible to run any searches or do anything when it happens.
We see the following error/warning when "Server Error" occurs
2018-05-07 10:25:38.865 sourcetype=splunkd component=HttpListener host=<splunk indexer name> log_level=ERROR
Message=Exception while processing request from 10.xx.xx.xxx for /services/streams/search?sh_sid=username1__username1_c3BsdW5rX21vbml0b3JpbmdfY29uc29sZQ__search9_1525703138.185950: Connection closed by peer
Warning:
2018-05-07 10:26:00.276 sourcetype=splunkd component=DispatchManager host=<splunk search header name> Message= quota enforcement for user=username1, sid=1525703125.128564_E1EDCF3F-8C8F-4C77-A662-09D345FAC644, elapsed_ms=34734, cache_size=3936 took longer than 15 seconds. Poor search start performance will be observed. Consider removing some old search job artifacts.
We will appreciate any suggestions.
Thank you
Update: This was part of High CPU usage issue we experienced. The issue was registered as a bug (SPL-153036) and as a solution we updated Splunk from version 7.0.1 to 7.0.4.1 on our search heads and cluster master
Update: This was part of High CPU usage issue we experienced. The issue was registered as a bug (SPL-153036) and as a solution we updated Splunk from version 7.0.1 to 7.0.4.1 on our search heads and cluster master