Long-running Search Timeout With No Results

[mike-mcgrail]

When executing long-running searches via search command, Splunk completes search after approximately 90 seconds (sometimes 91, sometimes 92) with no results and shows error Expecting value: line 1 column 1 (char 0). From search log:

04-11-2023 14:11:15.544 INFO  SearchStatusEnforcer [6084307 StatusEnforcerThread] - Enforcing disk quota = 10485760000
04-11-2023 14:11:15.545 INFO  UserManager [6084314 phase_1] - Done setting user context: NULL -> admin
04-11-2023 14:11:15.545 INFO  PreviewExecutor [6084307 StatusEnforcerThread] - Preview Enforcing initialization done
04-11-2023 14:11:15.545 INFO  ReducePhaseExecutor [6084314 phase_1] - Starting phase_1
04-11-2023 14:11:16.552 INFO  ReducePhaseExecutor [6084307 StatusEnforcerThread] - ReducePhaseExecutor=1 action=PREVIEW
04-11-2023 14:12:46.025 ERROR ChunkedExternProcessor [6084287 ChunkedExternProcessorStderrLogger] - stderr: Expecting value: line 1 column 1 (char 0)
04-11-2023 14:12:46.028 ERROR ChunkedExternProcessor [6084287 ChunkedExternProcessorStderrLogger] - stderr: Abnormal exit: ERROR

Adjusting srchDiskQuota in authorize.conf does not resolve, but SearchStatusEnforcer [6084307 StatusEnforcerThread] - Enforcing disk quota log line does update to the value set.

[mike-mcgrail]

Eliminated Python requests timeout as cause - if set to low value search will stop at timeout threshold, if set to high value search still times out with disk quota.

[mike-mcgrail]

Eliminated web.conf job_default_auto_cancel as cause.

[mike-mcgrail]

|rest /services/search/jobs splunk_server=local shows diskUsage=77824; isDone=1.

[mike-mcgrail]

https://github.com/scalyr/dataset-addon-for-splunk/pull/15/commits

[mike-mcgrail]

Completed in v2.0.0