Scheduled Search Errors and Resolutions
When investigating errors to identify issues, make use of the message and suggestion fields to provide guidance on why an issue has occurred. The list below describes each message type.
Info: is informational and does not require action.
Warning: there is something to be aware of. In some cases, the warning resolves on its own. But if the message persists, it may require action.
Error: there is an error that requires action.
You can monitor alert errors in the humio-activity repository. For more information about monitoring alert execution in the humio-activity repository, see Monitor Alerts with humio-activity Repository .
The table below lists the messages for scheduled searches in the UI and corresponding suggestions to resolve issues.
Table: Scheduled search errors and solutions
| Message | Version | Severity | Description | Solution |
|---|---|---|---|---|
| Problem firing action | Error | There was a problem starting the action for the scheduled search. | This message may self resolve. Otherwise, review the scheduled search and check the actions. For more information about actions, see Actions. | |
| Polling scheduled search query resulted in an error | Error | The alert query produced an error. This can be due to many different reasons. |
Look at the message in the exceptionMessage and
consult documentation based upon that for possible solutions.
| |
| Could not submit scheduled search query | Error | There can be several reasons that it is not possible to submit the query. |
Look at the exceptionMessage and consult
documentation based upon that for possible solutions. Contact
LogScale Support for
assistance if needed.
| |
| Scheduled search query took too long and the result is now outside the backfill limit. LogScale will skip this run and start the next scheduled run. | Error | The scheduled search query took too long to run and has reached the backfill limit. The system will skip the run and start the net scheduled run. | Edit the scheduled search query, if possible, so it does not take too long to run. For information about editing scheduled searches, see Creating a Scheduled Search. For information about writing better queries, see Query Writing Best Practices. If the message persists after editing the query, contact LogScale Support. | |
| Scheduled search is broken and will not run | Error | The scheduled search is broken and will not run. This is likely due to a configuration. | Update and save the scheduled search again. | |
| Scheduled search is being stopped, since the scheduled search is broken | Error | The scheduled search is broken and will not run. This is likely due to a configuration. | Update and save the scheduled search again. | |
| Scheduled search is being stopped, since the scheduled search is not assigned to run on any node | Error | The scheduled search is not assigned to run on any nodes. Scheduled searches are distrubted evenly among the nodes in a cluster, so that each one runs on a single node. Reassignment of nodes on which scheduled searches run occurs automatically when new cluster nodes are added or old cluster nodes are removed. | If the scheduled search does not run on another node after 15 minutes, contact LogScale Support. | |
| Cannot run ${triggerType.toLowerCase}. ${triggerType} was saved by a user that does not exist anymore. Change the ${triggerType.toLowerCase} to run as a different user or on behalf of the organization. | 1.166.0 | Error | The scheduled search was saved by a user that no longer exists. | You have to either change the scheduled search to run as a user that exists in the system, or change the scheduled search to run on behalf of the organization. For more information, see Creating a Scheduled Search. |
| Cannot run ${triggerType.toLowerCase}. ${triggerType} was saved by a user that does not exist anymore. Change the alert to run as a different user or on behalf of the organization. | Error | The scheduled search was saved by a user that no longer exists. | You have to either change the scheduled search to run as a user that exists in the system, or change the scheduled search to run on behalf of the organization. For more information, see Creating a Scheduled Search. | |
| Cannot run ${triggerType.toLowerCase}. ${triggerType} was saved by a user that no longer has read permission on the view. Grant the user permission again, or change the alert to run as a different user or on behalf of the organization. | Error | The scheduled search cannot run because it was saved by a user that does not have read permission on the view now. | You have to either grant the user read permissions on the repository or view that the scheduled search is running in, change the scheduled search to run as another user with such permissions, or change the scheduled search to run on behalf of the organization. For more information, see Creating a Scheduled Search. | |
| Cannot run ${triggerType.toLowerCase}. ${triggerType} was saved by a user that no longer has read permission on the view. Grant the user permission again, or change the ${triggerType.toLowerCase} to run as a different user or on behalf of the organization. | 1.166.0 | Error | The scheduled search cannot run because it was saved by a user that does not have read permission on the view now. | You have to either grant the user read permissions on the repository or view that the scheduled search is running in, change the scheduled search to run as another user with such permissions, or change the scheduled search to run on behalf of the organization. For more information, see Creating a Scheduled Search. |
| Scheduled search has been disabled and the scheduled search query will be cancelled | Info | The alert was disabled and cannot run. | If you want the alert to run, enable it again. For more information about how to do this, see Editing Alerts. | |
| Scheduled search found no results and will not trigger | Info | The scheduled search query, as configured, found no events that matched its requirements and no actions will trigger. | None. This message is informational. | |
| Scheduled search is running on a view that is not connected to any repository. The scheduled search query will be cancelled | Info | The alert contains a view that is not connected to any repository. | Edit the view to connect it to a repository, or edit the alert to use another view that is connected to a repository. | |
| Scheduled search firing actions | Info | The scheduled search is firing actions. | None. This message is informational. | |
| License has expired and scheduled search will not be run. | Info | The license has expired and must be renewed to continue. | Contact LogScale Support for assistance. | |
| Scheduled search no longer has any associated actions and the scheduled search query will be cancelled | Info | The alert has no associated actions. Because a successful alert must trigger at least one action, the alert is stopped. | Edit the alert to add actions and save it. For more information about how to do this, see Editing Alerts. | |
| Scheduled search encountered a cancelled query | Info | The query was cancelled before execution could complete. | The cancelled query will be restarted automatically. If the problem persists, contact the system administrator. | |
| Query was not started as the node is shutting down | Info | Scheduled search job was not started because the node is shutting down. | None. This message is informational. Once the node restarts, scheduled searches will run. Contact the system administrator if the node downtime was unexpected. | |
| Query started | Info | The query started successfully. | None. This message is informational. | |
| Scheduled search lacked behind and had to be rescheduled | Info | The scheduled search lagged behind and had to be rescheduled. This is sometimes due to the query configuration. | If LogScale was running fine when the search was scheduled, you might need to optimize the query. For information about writing better queries, see Writing Better Queries. | |
| Scheduled search lagged behind and had to be rescheduled | 1.152.0 | Info | The scheduled search lagged behind and had to be rescheduled. This is sometimes due to the query configuration. | If LogScale was running fine when the search was scheduled, you might need to optimize the query. For information about writing better queries, see Writing Better Queries. |
| Scheduled search query is still running | Info | The scheduled search query is still running. | None. This message is informational. If the scheduled search query continues to run for an unreasonable amount of time, contact LogScale Support. | |
| Scheduled search is being stopped, since the scheduled search is assigned to run on node $vhost | Info | The scheduled search was assigned to run on a another node in the cluster. | None. This message is informational. | |
| Scheduled search is being stopped, since the scheduled search was deleted | Info | The scheduled search was deleted and will not run. | It is not possible to recover a deleted scheduled search. If you want it to run, you must create the scheduled search again. | |
| Scheduled search is being stopped, since the organization of the scheduled search was deleted | Info | The organization for which the scheduled search was created has been deleted. | Recreate the scheduled search for another organization. | |
| Scheduled search is being stopped, since the organization is being transferred | Info | The organization is being transferred to a new cluster, and scheduled searches are stopped during the transfer process. | If not resolved after 15 minutes, contact Logscale Support for more information. | |
| Scheduled search is being stopped, since the view of the scheduled search was deleted | Info | The view with which the scheduled search was associated has been deleted and the job cannot run. | Add the scheduled search to another view. | |
| Scheduled search successfully triggered at least one action | Info | The scheduled search successfully triggered at least one action. | None. This message is informational. | |
| Polling scheduled search query resulted in warnings that are normally treated as errors. The scheduled search will still trigger actions if it finds any events | Info | Polling the scheduled search query resulted in warnings that are normally treated as errors. The scheduled search will still trigger actions if the result contains events. | This message is informational and does not require action. However, consider whether the specific messages in the errors field should be fixed. | |
| Could not cancel scheduled search query | Warning | The alert query could not be stopped. Query should not run. | None. This message is informational. | |
| Could not submit scheduled search query | Warning | There can be several reasons that it is not possible to submit the query. |
Look at the exceptionMessage and consult
documentation based upon that for possible solutions. Contact
LogScale Support for
assistance if needed.
| |
| Encountered an error starting a scheduled search query | Warning |
Scheduled search did not start due to the error described in the
exceptionMessage.
|
Look at the exceptionMessage and consult the
documentation for possible solutions.
| |
| Could not fire actions for scheduled search | Warning | The actions of the scheduled search could not be triggered. No actions in the scheduled search were triggered. |
Look at the exceptionMessage and consult the
documentation for possible solutions. Check the action
configuration in the scheduled search and ensure that there are no
operational issues with the action type's system, such as email,
pager, etc. Check the (category scheduled search, subcategory
action) for specific information about the actions that failed.
| |
| Unknown action | Warning | The alert contains an unknown action. | Edit the alert, remove the action, and add a different action. | |
| Could not submit query for scheduled search as it is blocked. | Warning | The alert query cannot run since it is blocked. | Either rewrite the alert query so it is no longer blocked, or check with the system administrator and remove the query from the blocklist. If using LogScale Cloud, this error can occur if the cluster is in a maintenance window. | |
| Scheduled search query is blocked. Either rewrite the query or get it unblocked. | 1.166.0 | Warning | The alert query cannot run since it is blocked. | Either rewrite the alert query so it is no longer blocked, or check with the system administrator and remove the query from the blocklist. If using LogScale Cloud, this error can occur if the cluster is in a maintenance window. |
| Scheduled search query was cancelled and will be restarted | Warning | The alert encountered a cancelled query during execution. | None. This message is informational. The alert query will be restarted automatically. If this happens frequently, review the alert configuration and contact LogScale Support, if needed. | |
| Polling scheduled search query resulted in warnings about missing data. The scheduled search will be retried for a while | Warning | The files with the data might be unavailable or the query might not be able to run at the time of execution. | No action is required. The scheduled search will start again automatically. | |
| Polling the scheduled search in the previous loop has not finished. The scheduled search will not be polled in this loop | Warning | The scheduled search did not finish in the previous run, so it cannot be polled in the current run. | None. This message is informational. If the problem continues, you can disable the scheduled search, wait one minute, and enable the scheduled search. NOTE: If you do this you may lose results. | |
| Some of the actions invoked by the scheduled search in the previous loop have not finished and none have finished successfully. The scheduled search will not be polled in this loop | Warning | To be successful, a scheduled search must have at least one successful action. This error indicates that some of the actions in the scheduled search have not finished and none have finished successfully. Therefore, the scheduled search has no successful actions. | This warning can self-resolve. If the issue persists, contact the system administrator or LogScale Support. | |
| The backfill limit is higher than the allowed maximum. Defaulting to the maximum | Warning | The backfill limit configured on the scheduled search is higher than the allowed maximum. The system defaults to the maximum allowed automatically. | Decrease the backfill limit on the scheduled search or increase the configured maximum. | |
| Polling scheduled search query resulted in warnings that are treated as errors. The scheduled search will not trigger any actions if it finds any events | Warning | Polling scheduled search query resulted in warnings that are treated as errors. The scheduled search will not trigger if the result contains events. | In this case, you must look at the specific messages in the errors field and fix them, if possible. |