Users who receive a link to a search are receiving an "Unknown sid" error message when they open the link. Why is this happening?

Question

Options

• AThe users have insufficient permissions.
• BAn add-on needs to be updated.
• CThe search job has expired.
• DOne or more indexers are down.

• B
  4% (1)
• C
  91% (21)
• D
  4% (1)

Explanation

According to the Splunk documentation1, the "Unknown sid" error message means that the search job associated with the link has expired or been deleted. The sid (search ID) is a unique identifier for each search job, and it is used to retrieve the results of the search. If the sid is not found, the search cannot be displayed. The other options are false because: The users having insufficient permissions would result in a different error message, such as "You do not have permission to view this page" or "You do not have permission to run this search"1. An add-on needing to be updated would not affect the validity of the sid, unless the add-on changes the search syntax or the data source in a way that makes the search invalid or inaccessible1. One or more indexers being down would not cause the "Unknown sid" error, as the sid is stored on the search head, not the indexers. However, it could cause other errors, such as "Unable to distribute to peer" or "Search peer has the following message: not enough disk space"1.

No community discussion yet for this question.