Why are we seeing a "Server Error" message after each search, login attempt, etc. on our search head and indexer?

[nivedita_viswan]

We have 1 indexer and 1 search head in our Splunk environment.
Since this morning, after every search is run, a 'Server Error' message is seen, both on the search head, as well as the indexer. The search continues to run and even completes without any real error. However, this message always appears when the search completes/ is paused/ finalized.

Even during a failed login attempt (incorrect credentials), the 'Server Error' message is seen. This message is also seen when scheduled searches and alerts are run.

What could be the reason for the 'Server Error' message? I skimmed through the logs, and there is nothing unusual there.

[di2esysadmin]

Your Splunk user might not have permission to create and update alerts. 

[nivedita_viswan · Accepted solution]

I never did figure out what was causing the message. Re-installing my browser fixed the issue though.

[emiller42]

Might want to pop open your browsers developer console and look to see if there are any errors there. Because Splunk is a RESTful app, there are a bunch of requests going on under the hood, and if one of them fails, you see the generic 'server error' messages.

Hopefully there's a bad HTTP response code attached to a specific endpoint, which you can then chase down in the logs.