Scheduled Search Errors and Resolutions

When investigating errors to identify issues, make use of the message and suggestion fields to provide guidance on why an issue has occurred. The list below describes each message type.

  • Info: is informational and does not require action.

  • Warning: there is something to be aware of. In some cases, the warning resolves on its own. But if the message persists, it may require action.

  • Error: there is an error that requires action.

You can monitor alert errors in the humio-activity repository. For more information about monitoring alert execution in the humio-activity repository, see Monitor Alerts with humio-activity Repository .

The table below lists the messages for scheduled searches in the UI and corresponding suggestions to resolve issues.

Table: Scheduled search errors and solutions

MessageSeverityDescriptionSolution
Polling scheduled search query resulted in an error Error The alert query produced an error. This can be due to many different reasons. Look at the message in the exceptionMessage and consult documentation based upon that for possible solutions.
Could not submit scheduled search query Error There can be several reasons that it is not possible to submit the query. Look at the exceptionMessage and consult documentation based upon that for possible solutions. Contact LogScale Support for assistance if needed.
Scheduled search is broken and will not run Error The scheduled search is broken and will not run. This is likely due to a configuration. Update and save the scheduled search again.
Scheduled search is being stopped, since the scheduled search is broken Error The scheduled search is broken and will not run. This is likely due to a configuration. Update and save the scheduled search again.
Scheduled search is being stopped, since the scheduled search is not assigned to run on any node Error The scheduled search is not assigned to run on any nodes. Scheduled searches are distrubted evenly among the nodes in a cluster, so that each one runs on a single node. Reassignment of nodes on which scheduled searches run occurs automatically when new cluster nodes are added or old cluster nodes are removed. If the scheduled search does not run on another node after 15 minutes, contact LogScale Support.
Scheduled search found no results and will not trigger Info The scheduled search query, as configured, found no events that matched its requirements and no actions will trigger. None. This message is informational.
Scheduled search firing actions Info The scheduled search is firing actions. None. This message is informational.
Scheduled search encountered a cancelled query Info The query was cancelled before execution could complete. The cancelled query will be restarted automatically. If the problem persists, contact the system administrator.
Query was not started as the node is shutting down Info Scheduled search job was not started because the node is shutting down. None. This message is informational. Once the node restarts, scheduled searches will run. Contact the system administrator if the node downtime was unexpected.
Query started Info The query started successfully. None. This message is informational.
Scheduled search lagged behind and had to be rescheduled Info The scheduled search lagged behind and had to be rescheduled. This is sometimes due to the query configuration. If LogScale was running fine when the search was scheduled, you might need to optimize the query. For information about writing better queries, see Writing Better Queries.
Scheduled search query is still running Info The scheduled search query is still running. None. This message is informational. If the scheduled search query continues to run for an unreasonable amount of time, contact LogScale Support.
Scheduled search is being stopped, since the scheduled search is assigned to run on node $vhost Info The scheduled search was assigned to run on a another node in the cluster. None. This message is informational.
Scheduled search is being stopped, since the scheduled search was deleted Info The scheduled search was deleted and will not run. It is not possible to recover a deleted scheduled search. If you want it to run, you must create the scheduled search again.
Scheduled search is being stopped, since the organization of the scheduled search was deleted Info The organization for which the scheduled search was created has been deleted. Recreate the scheduled search for another organization.
Scheduled search is being stopped, since the organization is being transferred Info The organization is being transferred to a new cluster, and scheduled searches are stopped during the transfer process. If not resolved after 15 minutes, contact Logscale Support for more information.
Scheduled search is being stopped, since the view of the scheduled search was deleted Info The view with which the scheduled search was associated has been deleted and the job cannot run. Add the scheduled search to another view.
Scheduled search successfully triggered at least one action Info The scheduled search successfully triggered at least one action. None. This message is informational.
Polling scheduled search query resulted in warnings that are normally treated as errors. The scheduled search will still trigger actions if it finds any events Info Polling the scheduled search query resulted in warnings that are normally treated as errors. The scheduled search will still trigger actions if the result contains events. This message is informational and does not require action. However, consider whether the specific messages in the errors field should be fixed.
Polling the scheduled search in the previous loop has not finished. The scheduled search will not be polled in this loop Warning The alert did not finish in the previous run, so it cannot be polled in the current run. None. This message is informational. If the problem continues, you can disable the alert, wait one minute, and enable the alert. NOTE: If you do this you may lose results.
Some of the actions invoked by the scheduled search in the previous loop have not finished and none have finished successfully. The scheduled search will not be polled in this loop Warning To be successful, an alert must have at least one successful action. This error indicates that some of the actions in the alert have not finished and none have finished successfully. Therefore, the alert has no successful actions. This warning can self-resolve. If the issue persists, contact the system administrator or LogScale Support.
Could not cancel scheduled search query Warning The alert query could not be stopped. Query should not run. None. This message is informational.
Could not submit scheduled search query Warning There can be several reasons that it is not possible to submit the query. Look at the exceptionMessage and consult documentation based upon that for possible solutions. Contact LogScale Support for assistance if needed.
Encountered an error starting a scheduled search query Warning Scheduled search did not start due to the error described in the exceptionMessage. Look at the exceptionMessage and consult the documentation for possible solutions.
Could not fire actions for scheduled search Warning The actions of the scheduled search could not be triggered. No actions in the scheduled search were triggered. Look at the exceptionMessage and consult the documentation for possible solutions. Check the action configuration in the scheduled search and ensure that there are no operational issues with the action type's system, such as email, pager, etc. Check the (category scheduled search, subcategory action) for specific information about the actions that failed.
Problem firing action Warning There was a problem starting the action for the scheduled search. This message may self resolve. Otherwise, review the scheduled search and check the actions. For more information about actions, see Actions.
Cannot run ${triggerType.toLowerCase}. ${triggerType} was saved by a user that does not exist anymore. Change the alert to run as a different user or on behalf of the organization. Warning The scheduled search was saved by a user that no longer exists. You have to either change the scheduled search to run as a user that exists in the system, or change the scheduled search to run on behalf of the organization. For more information, see Creating a Scheduled Search.
Cannot run ${triggerType.toLowerCase}. ${triggerType} was saved by a user that no longer has read permission on the view. Grant the user permission again, or change the alert to run as a different user or on behalf of the organization. Warning The scheduled search cannot run because it was saved by a user that does not have read permission on the view now. You have to either grant the user read permissions on the repository or view that the scheduled search is running in, change the scheduled search to run as another user with such permissions, or change the scheduled search to run on behalf of the organization. For more information, see Creating a Scheduled Search.
Unknown action Warning The alert contains an unknown action. Edit the alert, remove the action, and add a different action.
Could not submit query for scheduled search as it is blocked. Warning The alert query cannot run since it is blocked. Either rewrite the alert query so it is no longer blocked, or check with the system administrator and remove the query from the blocklist. If using LogScale Cloud, this error can occur if the cluster is in a maintenance window.
Scheduled search query was cancelled and will be restarted Warning The alert encountered a cancelled query during execution. None. This message is informational. The alert query will be restarted automatically. If this happens frequently, review the alert configuration and contact LogScale Support, if needed.
Polling scheduled search query resulted in warnings about missing data. The scheduled search will be retried for a while Warning The files with the data might be unavailable or the query might not be able to run at the time of execution. No action is required. The scheduled search will start again automatically.
The backfill limit is higher than the allowed maximum. Defaulting to the maximum Warning The backfill limit configured on the scheduled search is higher than the allowed maximum. The system defaults to the maximum allowed automatically. Decrease the backfill limit on the scheduled search or increase the configured maximum.
Polling scheduled search query resulted in warnings that are treated as errors. The scheduled search will not trigger any actions if it finds any events Warning Polling scheduled search query resulted in warnings that are treated as errors. The scheduled search will not trigger if the result contains events. In this case, you must look at the specific messages in the errors field and fix them, if possible.