Skip to content
This is an archived version of the documentation downloaded from LogScale Documentation Archives. Up to date documentation, and documentation for later versions, is available on LogScale Documentation

### Scheduled Search Errors and Resolutions

When investigating errors to identify issues, make use of the message and suggestion fields to provide guidance on why an issue has occurred. The list below describes each message type.

- Info: is informational and does not require action.

- Warning: there is something to be aware of. In some cases, the warning resolves on its own. But if the message persists, it may require action.

- Error: there is an error that requires action.

You can monitor alert errors in the humio-activity repository. For more information about monitoring alert execution in the humio-activity repository, see Monitor Alerts with humio-activity Repository .

The table below lists the messages for scheduled searches in the UI and corresponding suggestions to resolve issues.

Table: Scheduled search errors and solutions

Message | Version | Severity | Status | Description | Solution
--- | --- | --- | --- | --- | ---
Problem firing action |  | `Error` | `` | There was a problem starting the action for the scheduled search. | This message may self resolve. Otherwise, review the scheduled search and check the actions. For more information about actions, see Actions.
Could not submit scheduled search query |  | `Error` | `` | There can be several reasons that it is not possible to submit the query. | Look at the `exceptionMessage` and consult documentation based upon that for possible solutions. Contact LogScale Support for assistance if needed.
Encountered an error starting a scheduled search query |  | `Error` | `` | Scheduled search did not start due to the error described in the `exceptionMessage`. | Look at the `exceptionMessage` and consult the documentation for possible solutions.
Could not fire actions for scheduled search |  | `Error` | `` | The actions of the scheduled search could not be triggered. No actions in the scheduled search were triggered. | Look at the `exceptionMessage` and consult the documentation for possible solutions. Check the action configuration in the scheduled search and ensure that there are no operational issues with the action type's system, such as email, pager, etc. Check the (category scheduled search, subcategory action) for specific information about the actions that failed.
Could not submit query for scheduled search as it is blocked. |  | `Error` | `` | The scheduled search query cannot run since it is blocked. | Either rewrite the scheduled search query so it is no longer blocked, or check with the system administrator and remove the query from the blocklist. If using LogScale Cloud, this error can occur if the cluster is in a maintenance window.
Scheduled search query is blocked. Either rewrite the query or get it unblocked. | 1.166.0 | `Error` | `` | The scheduled search query cannot run since it is blocked. | Either rewrite the scheduled search query so it is no longer blocked, or check with the system administrator and remove the query from the blocklist. If using LogScale Cloud, this error can occur if the cluster is in a maintenance window.
Polling scheduled search query resulted in an error |  | `Error` | `` | The scheduled search query produced an error. This can be due to many different reasons. | Look at the message in the `exceptionMessage` and consult documentation based upon that for possible solutions.
Could not submit scheduled search query |  | `Error` | `` | There can be several reasons that it is not possible to submit the query. | Look at the `exceptionMessage` and consult documentation based upon that for possible solutions. Contact LogScale Support for assistance if needed.
Scheduled search is broken and will not run |  | `Error` | `` | The scheduled search is broken and will not run. This is likely due to a configuration. | Update and save the scheduled search again.
Scheduled search is being stopped, since the scheduled search is broken |  | `Error` | `` | The scheduled search is broken and will not run. This is likely due to a configuration. | Update and save the scheduled search again.
Scheduled search is being stopped, since the scheduled search is not assigned to run on any node |  | `Error` | `` | The scheduled search is not assigned to run on any nodes. Scheduled searches are distributed evenly among the nodes in a cluster, so that each one runs on a single node. Reassignment of nodes on which scheduled searches run occurs automatically when new cluster nodes are added or old cluster nodes are removed. | If the scheduled search does not run on another node after 15 minutes, contact LogScale Support.
Cannot run ${triggerType.toLowerCase}. ${triggerType} was saved by a user that does not exist anymore. Change the alert to run as a different user or on behalf of the organization. |  | `Error` | `` | The scheduled search was saved by a user that no longer exists. | You have to either change the scheduled search to run as a user that exists in the system, or change the scheduled search to run on behalf of the organization. For more information, see Creating a Scheduled Search.
Cannot run ${triggerType.toLowerCase}. ${triggerType} was saved by a user that does not exist anymore. Change the ${triggerType.toLowerCase} to run as a different user or on behalf of the organization. | 1.166.0 | `Error` | `` | The scheduled search was saved by a user that no longer exists. | You have to either change the scheduled search to run as a user that exists in the system, or change the scheduled search to run on behalf of the organization. For more information, see Creating a Scheduled Search.
Cannot run ${triggerType.toLowerCase}. ${triggerType} was saved by a user that no longer has read permission on the view. Grant the user permission again, or change the alert to run as a different user or on behalf of the organization. |  | `Error` | `` | The scheduled search cannot run because it was saved by a user that does not have read permission on the view now. | You have to either grant the user read permissions on the repository or view that the scheduled search is running in, change the scheduled search to run as another user with such permissions, or change the scheduled search to run on behalf of the organization. For more information, see Creating a Scheduled Search.
Cannot run ${triggerType.toLowerCase}. ${triggerType} was saved by a user that no longer has read permission on the view. Grant the user permission again, or change the ${triggerType.toLowerCase} to run as a different user or on behalf of the organization. | 1.166.0 | `Error` | `` | The scheduled search cannot run because it was saved by a user that does not have read permission on the view now. | You have to either grant the user read permissions on the repository or view that the scheduled search is running in, change the scheduled search to run as another user with such permissions, or change the scheduled search to run on behalf of the organization. For more information, see Creating a Scheduled Search.
Polling scheduled search query resulted in warnings that are treated as errors. The scheduled search will not trigger any actions if it finds any events |  | `Error` | `` | Polling scheduled search query resulted in warnings that are treated as errors. The scheduled search will not trigger if the result contains events. | In this case, you must look at the specific messages in the errors field and fix them, if possible.
Scheduled search has been disabled and the scheduled search query will be cancelled |  | `Info` | `` | The scheduled search was disabled by a user and cannot run. | If you want the scheduled search to run, enable it again. For more information about how to do this, see Editing Alerts.
Scheduled search found no results and will not trigger |  | `Info` | `` | The scheduled search query, as configured, found no events that matched its requirements and no actions will trigger. | None. This message is informational.
Scheduled search is running on a view that is not connected to any repository. The scheduled search query will be cancelled |  | `Info` | `` | The scheduled search contains a view that is not connected to any repository. | Edit the view to connect it to a repository, or edit the scheduled search to use another view that is connected to a repository.
Scheduled search firing actions |  | `Info` | `` | The scheduled search is firing actions. | None. This message is informational.
License has expired and scheduled search will not be run. |  | `Info` | `` | The license has expired and must be renewed to continue. | Contact LogScale Support for assistance.
Scheduled search no longer has any associated actions and the scheduled search query will be cancelled |  | `Info` | `` | The scheduled search has no associated actions. Because a successful scheduled search must trigger at least one action, the scheduled search is stopped. | Edit the scheduled search to add actions and save it. For more information about how to do this, see Editing Alerts.
Query was not started as the node is shutting down |  | `Info` | `` | Scheduled search job was not started because the node is shutting down. | None. This message is informational. Once the node restarts, scheduled searches will run. Contact the system administrator if the node downtime was unexpected.
Query started |  | `Info` | `` | The query started successfully. | None. This message is informational.
Scheduled search query is still running |  | `Info` | `` | The scheduled search query is still running. | None. This message is informational. If the scheduled search query continues to run for an unreasonable amount of time, contact LogScale Support.
Scheduled search is being stopped, since the scheduled search is assigned to run on node $vhost |  | `Info` | `` | The scheduled search was assigned to run on a another node in the cluster. | None. This message is informational.
Scheduled search is being stopped, since the scheduled search was deleted |  | `Info` | `` | The scheduled search was deleted and will not run. | It is not possible to recover a deleted scheduled search. If you want it to run, you must create the scheduled search again.
Scheduled search is being stopped, since the organization of the scheduled search was deleted |  | `Info` | `` | The organization for which the scheduled search was created has been deleted. | Recreate the scheduled search for another organization.
Scheduled search is being stopped, since the organization is being transferred |  | `Info` | `` | The organization is being transferred to a new cluster, and scheduled searches are stopped during the transfer process. | If not resolved after 15 minutes, contact Logscale Support for more information.
Scheduled search is being stopped, since the view of the scheduled search was deleted |  | `Info` | `` | The view with which the scheduled search was associated has been deleted and the job cannot run. | Add the scheduled search to another view.
Scheduled search successfully triggered at least one action |  | `Info` | `` | The scheduled search successfully triggered at least one action. | None. This message is informational.
Polling the scheduled search in the previous loop has not finished. The scheduled search will not be polled in this loop |  | `Warning` | `Failure` | The scheduled search did not finish in the previous run, so it cannot be polled in the current run. | None. This message is informational. If the problem continues, you can disable the scheduled search, wait one minute, and enable the alert. NOTE: If you do this you may lose results.
Some of the actions invoked by the scheduled search in the previous loop have not finished and none have finished successfully. The scheduled search will not be polled in this loop |  | `Warning` | `Failure` | To be successful, a scheduled search must have at least one successful action. This error indicates that some of the actions in the scheduled search have not finished and none have finished successfully. Therefore, the scheduled search has no successful actions. | This warning can self-resolve. If the issue persists, contact the system administrator or LogScale Support.
Could not cancel scheduled search query |  | `Warning` | `` | The scheduled search query could not be stopped. Query should not run. | None. This message is informational.
Problem firing action |  | `Warning` | `` | There was a problem starting the action for the scheduled search. | This message may self resolve. Otherwise, review the scheduled search and check the actions. For more information about actions, see Actions.
Cannot run ${triggerType.toLowerCase}. ${triggerType} was saved by a user that does not exist anymore. Change the alert to run as a different user or on behalf of the organization. | 1.144.0 | `Warning` | `Failure` | The scheduled search was saved by a user that no longer exists. | You have to either change the scheduled search to run as a user that exists in the system, or change the scheduled search to run on behalf of the organization. For more information, see Creating a Scheduled Search.
Cannot run ${triggerType.toLowerCase}. ${triggerType} was saved by a user that does not exist anymore. |  | `Warning` | `Failure` | The scheduled search was saved by a user that no longer exists. | You have to either change the scheduled search to run as a user that exists in the system, or change the scheduled search to run on behalf of the organization. For more information, see Creating a Scheduled Search.
Cannot run ${triggerType.toLowerCase}. ${triggerType} was saved by a user that no longer have read permission on the view. |  | `Warning` | `Failure` | The scheduled search cannot run because it was saved by a user that does not have read permission on the view now. | You have to either grant the user read permissions on the repository or view that the scheduled search is running in, change the scheduled search to run as another user with such permissions, or change the scheduled search to run on behalf of the organization. For more information, see Creating a Scheduled Search.
Cannot run ${triggerType.toLowerCase}. ${triggerType} was saved by a user that no longer has read permission on the view. Grant the user permission again, or change the alert to run as a different user or on behalf of the organization. | 1.144.0 | `Warning` | `Failure` | The scheduled search cannot run because it was saved by a user that does not have read permission on the view now. | You have to either grant the user read permissions on the repository or view that the scheduled search is running in, change the scheduled search to run as another user with such permissions, or change the scheduled search to run on behalf of the organization. For more information, see Creating a Scheduled Search.
Unknown action |  | `Warning` | `` | The scheduled search contains an unknown action. | Edit the scheduled search, remove the action, and add a different action.
Scheduled search encountered a cancelled query |  | `Warning` | `` | The query was cancelled before execution could complete. | The cancelled query will be restarted automatically. If the problem persists, contact the system administrator.
Scheduled search query was cancelled and will be restarted |  | `Warning` | `` | The scheduled search encountered a cancelled query during execution. | None. This message is informational. The scheduled search query will be restarted automatically. If this happens frequently, review the scheduled search configuration and contact LogScale Support, if needed.
Scheduled search lacked behind and had to be rescheduled |  | `Warning` | `` | The scheduled search lagged behind and had to be rescheduled. This is sometimes due to the query configuration. | If LogScale was running fine when the search was scheduled, you might need to optimize the query. For information about writing better queries, see Statement order for better queries.
Scheduled search lagged behind and had to be rescheduled | 1.152.0 | `Warning` | `` | The scheduled search lagged behind and had to be rescheduled. This is sometimes due to the query configuration. | If LogScale was running fine when the search was scheduled, you might need to optimize the query. For information about writing better queries, see Statement order for better queries.
Polling scheduled search query resulted in warnings about missing data. The scheduled search will be retried for a while |  | `Warning` | `` | The files with the data might be unavailable or the query might not be able to run at the time of execution. | No action is required. The scheduled search will start again automatically.
Polling the scheduled search in the previous loop has not finished. The scheduled search will not be polled in this loop |  | `Warning` | `` | The scheduled search did not finish in the previous run, so it cannot be polled in the current run. | None. This message is informational. If the problem continues, you can disable the scheduled search, wait one minute, and enable the scheduled search. NOTE: If you do this you may lose results.
Some of the actions invoked by the scheduled search in the previous loop have not finished and none have finished successfully. The scheduled search will not be polled in this loop |  | `Warning` | `` | To be successful, a scheduled search must have at least one successful action. This error indicates that some of the actions in the scheduled search have not finished and none have finished successfully. Therefore, the scheduled search has no successful actions. | This warning can self-resolve. If the issue persists, contact the system administrator or LogScale Support.
The backfill limit is higher than the allowed maximum. Defaulting to the maximum |  | `Warning` | `` | The backfill limit configured on the scheduled search is higher than the allowed maximum. The system defaults to the maximum allowed automatically. | Decrease the backfill limit on the scheduled search or increase the configured maximum.
Polling scheduled search query resulted in warnings that are normally treated as errors. The scheduled search will still trigger actions if it finds any events |  | `Warning` | `` | Polling the scheduled search query resulted in warnings that are normally treated as errors. The scheduled search will still trigger actions if the result contains events. | This message is informational and does not require action. However, consider whether the specific messages in the errors field should be fixed.

#### Enter search term