This is what I got today when running keyword search ingest module, as well as ad hoc keyword searches. The only keyword searches that work are not exact match -
2020-06-22 09:55:27.991 org.sleuthkit.autopsy.keywordsearch.Server isRunning
INFO: Solr server is running
2020-06-22 09:55:29.479 org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB setPragmas
INFO: sqlite-jdbc version 3.25.2 loaded in native mode
2020-06-22 09:55:29.512 org.sleuthkit.autopsy.casemodule.Case openAsCurrentCase
INFO: Opened XXXXXXXTest (XXXXXXXtest_20200619_071932) in G:\Shared\XXXXXXXQAServer_Only\XXXXXXXTest\XXXXXXXTest as the current case
2020-06-22 09:55:44.232 org.sleuthkit.autopsy.exceptions.AutopsyExceptionHandler publish
SEVERE: Unexpected error: Error, Error in RequestProcessor org.openide.nodes.AsynchChildren
2020-06-22 10:05:16.903 org.sleuthkit.autopsy.exceptions.AutopsyExceptionHandler publish
SEVERE: Unexpected error: Error, Error in RequestProcessor org.openide.nodes.AsynchChildren
Caused by: Expected mime type application/xml but got text/html.
Error 404 Not Found
HTTP ERROR 404
Problem accessing /solr/XXXXXXXtest_20200619_071932_20200619_071933/analysis/field. Reason:
Not Found
Powered by Jetty://
2020-06-22 10:05:25.74 org.sleuthkit.autopsy.core.Installer
INFO: core installer created
2020-06-22 10:05:25.766 org.sleuthkit.autopsy.casemodule.Case closeCurrentCase
INFO: Closing current case XXXXXXXTest (XXXXXXXtest_20200619_071932) in G:\Shared\XXXXXXXQAServer_Only\XXXXXXXTest\XXXXXXXTest
2020-06-22 10:05:27.773 org.sleuthkit.autopsy.casemodule.Case closeAppServiceCaseResources
SEVERE: Solr Keyword Search Service service failed to open case resources
java.util.concurrent.ExecutionException: org.apache.solr.client.solrj.impl.HttpSolrServer$RemoteSolrException: No such core exists ‘XXXXXXXtest_20200619_071932_20200619_071933’
java.util.concurrent.FutureTask.report(FutureTask.java:122)
java.util.concurrent.FutureTask.get(FutureTask.java:192)
org.sleuthkit.autopsy.casemodule.Case.closeAppServiceCaseResources(Case.java:2637)
org.sleuthkit.autopsy.casemodule.Case.close(Case.java:2585)
org.sleuthkit.autopsy.casemodule.Case.lambda$doCloseCaseAction$9(Case.java:2514)
java.util.concurrent.FutureTask.run(FutureTask.java:266)
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
java.lang.Thread.run(Thread.java:748)
org.apache.solr.client.solrj.impl.HttpSolrServer$RemoteSolrException: No such core exists ‘XXXXXXXtest_20200619_071932_20200619_071933’
java.util.concurrent.FutureTask.report(FutureTask.java:122)
java.util.concurrent.FutureTask.get(FutureTask.java:192)
org.sleuthkit.autopsy.casemodule.Case.closeAppServiceCaseResources(Case.java:2637)
org.sleuthkit.autopsy.casemodule.Case.close(Case.java:2585)
org.sleuthkit.autopsy.casemodule.Case.lambda$doCloseCaseAction$9(Case.java:2514)
java.util.concurrent.FutureTask.run(FutureTask.java:266)
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
java.lang.Thread.run(Thread.java:748)
2020-06-22 10:05:27.775 org.sleuthkit.autopsy.imagegallery.ImageGalleryController shutDown
INFO: Shutting down image gallery controller for case XXXXXXXTest (XXXXXXXtest_20200619_071932)
2020-06-22 10:05:27.776 org.sleuthkit.autopsy.imagegallery.datamodel.DrawableDB close
INFO: Closing the drawable.db
2020-06-22 10:05:27.777 org.sleuthkit.autopsy.imagegallery.ImageGalleryController shutDown
INFO: Completed shut down of image gallery controller for case XXXXXXXTest (XXXXXXXtest_20200619_071932)
Based on that log snippet I don’t see how any keyword searches could be working. It looks like Solr cannot find the core for the case.
I would suggest that, with Autopsy shut down, you delete the Solr core.properties file for the case then restart Autopsy, open the case and try searching again.
The location of the Solr core.properties file depends on your installation but it can usually be found on Windows under %APPDATA%\autopsy\solr. In that location you should see a folder with the same name as your case and in that folder there may be a file named “core.properties”. You can either delete the “core.properties” file or the folder it lives in. It will be recreated when you re-open the case.