topic Re: Show source is not loading for only one event in Monitoring Splunk

Show source is not loading for only one event

Splunk-Star — Mon, 03 Jun 2024 15:25:59 GMT

Show source is not loading for only one event, getting "Failed to find target event in final sorted event list. Cannot properly prune results" after loading

Re: Show source is not loading for only one event

gcusello — Mon, 03 Jun 2024 15:29:30 GMT

Hi @Splunk-Star,

could you share more infos, e.g. som screenshot?

Thank you.

Ciao.

Giuseppe

Re: Show source is not loading for only one event

Splunk-Star — Mon, 03 Jun 2024 16:17:00 GMT

index = "*" "a39d0417-bc8e-41fd-ae1f-7ed5566caed6" "*uploadstat*" status=Processed

Re: Show source is not loading for only one event

gcusello — Tue, 04 Jun 2024 06:11:32 GMT

Hi @Splunk-Star ,

Let me understand:

this is one of your events,
if you have many events, they are displayed,
if you have only one event, it isn't displayed,

is it correct?

have you this issue only with these logs or also with other logs?

Maybe the issue is related to the lenght of the log, I encountered an issue with very long logs, that were displayed with a very long delay for their dimension.

Did you tried to truncate it e.g. with substr:

index = "*" "a39d0417-bc8e-41fd-ae1f-7ed5566caed6" "*uploadstat*" status=Processed | eval _raw=substr(_raw,100)

Ciao.

Giuseppe

Re: Show source is not loading for only one event

Splunk-Star — Tue, 04 Jun 2024 10:12:17 GMT

What ever you have mentioned thats correct, only for one log we are facing this issue, for others show source is loading fine.

still getting after truncating :

Failed to find target event in final sorted event list. Cannot properly prune results

Re: Show source is not loading for only one event

Splunk-Star — Tue, 04 Jun 2024 10:18:06 GMT