topic Re: Event: Show source loading .... in Getting Data In

Event: Show source loading ....

chrisitanmoleck — Fri, 03 Jan 2020 08:31:19 GMT

Hello,

if I try to show the source of an event, splunk shows only "loading ...".
I took care, that the result is finalized.

We are using Splunk 8.0.1.

Edit:
I start a search with "host=..." and time=last 24h
I open an event -> event actions -> show source (event.png)
Now the loading screen will not display any result/source, just "loading ...." (show-source.png)

Re: Event: Show source loading ....

niketn — Fri, 03 Jan 2020 09:02:54 GMT

@chrisitanmolecki would it be possible for you to elaborate your issue? How, where and what is the issue? If possible please attach screenshots.

Re: Event: Show source loading ....

chrisitanmoleck — Fri, 03 Jan 2020 09:11:17 GMT

@niketnilay Now it should be more expressive

Re: Event: Show source loading ....

las — Fri, 03 Jan 2020 09:45:44 GMT

We see the exact same problem also on 8.0.1
@chrisitanmolecki have you opened a case with support?

Re: Event: Show source loading ....

chrisitanmoleck — Fri, 03 Jan 2020 09:47:11 GMT

@las No we haven't.

Re: Event: Show source loading ....

niketn — Fri, 03 Jan 2020 19:58:41 GMT

@chrisitanmolecki I tried the same and I was able to see the raw data under Show Source. I am also on 8.0.1. I had tried index=_internal host=*.

What is the exact query you have run?
Also how many events did you have?
Did you click on Show Source after you had pulled all the events?
Have you tried with index= and searching with shorter duration or may be with | head 1 to see Show Source works for you?
How about changing browsers to test?

Re: Event: Show source loading ....

chrisitanmoleck — Tue, 07 Jan 2020 06:57:27 GMT

@niketnilay

index=_internal host=*

Not working

What is the exact query you have run?

host=foo

The issue occurs at every host

Also how many events did you have?
Thats very different. From a few to several thousands.

Did you click on Show Source after you had pulled all the events?
No I pulled at out just one event

Have you tried with index= and searching with shorter duration or may be with | head 1 to see Show Source works for you?
That change nothing

How about changing browsers to test?
Same at IE11, FF65.0 and GC78.0

Re: Event: Show source loading ....

las — Tue, 07 Jan 2020 11:23:37 GMT

We are using windows Server 2016, that might have an impact

Re: Event: Show source loading ....

chrisitanmoleck — Tue, 07 Jan 2020 11:31:38 GMT

@las
We are using Suse Linux Enterprise Server 12 Sp4

Re: Event: Show source loading ....

niketn — Tue, 07 Jan 2020 19:11:16 GMT

So if both of you have same issue, even though I am not able to re-produce, this still seems like a bug. Work with Splunk Support! Do let us know the outcome.

Re: Event: Show source loading ....

chrisitanmoleck — Wed, 08 Jan 2020 06:51:51 GMT

@niketnilay
OK I will contact the support.
Cheers mate

Re: Event: Show source loading ....

chrisitanmoleck — Thu, 16 Jan 2020 12:46:59 GMT

Splunk support:
The Bug is solved on the next version that should be 8.0.2.
So the option would be to upgrade Splunk whenever this release comes out, we do not have an estimated date at the moment.

Re: Event: Show source loading ....

chrisitanmoleck — Fri, 21 Feb 2020 06:56:39 GMT

After updating to 8.0.2, the problem is solved!