topic Re: Blank screen instead of raw data in Dashboards & Visualizations

Blank screen instead of raw data

D2SI — Tue, 29 Oct 2019 11:54:43 GMT

Hello there,

Since a few months, Splunk randomly displays a blank screen where the raw data is usually shown.

It does not seem to depend on browser add-ons as I am experiencing the same issue with 3 different browsers:

As a temporary workaround, I use '| table _time _raw' to see the raw data but it is not convenient.

Out of the blue, it just comes back to normal a moment later.

The issue is very random but happens everyday.

Anyone would have a clue?

Thanks in advance for any hint!

Re: Blank screen instead of raw data

ivanreis — Wed, 30 Sep 2020 02:49:10 GMT

Is Splunk running on linux? Check if the user has the proper rights to read the entire Splunk directory. If not, re-apply the user permissions to the entire splunk folder.
Is this happen only for _internal index? Or Are others on the same issue?
Check if the file for _internal index is being updated with the most recent data at $Splunk_home/var/lib/splunk/_internaldb/db
If it did not work, please create a diag file ./splunk diag, open a case at splunk support and attach the diag file to the case.

Re: Blank screen instead of raw data

sandeepmakkena — Tue, 05 Nov 2019 00:11:09 GMT

Try using a different browser.

Re: Blank screen instead of raw data

woodcock — Tue, 05 Nov 2019 02:03:24 GMT

This is not random; you are exhausting all RAM that is available to your Browser. You should be able to see clear evidence of this by clicking on Activity -> Job Inespector -> search.log. You are doing it wrong. There is no reason to to look at Last 15 months of any data set without doing some kind of stats or chart function to reduce the bulk of the results that come back to the Search Head. To test, try adding | stats count dc(host) BY sourcetype and you will almost certainly get results. No Search Head session can process GB of final results, nor should it be expected to.

Re: Blank screen instead of raw data

D2SI — Wed, 06 Nov 2019 00:08:26 GMT

I kinda did ! but thanks 🙂

Re: Blank screen instead of raw data

D2SI — Wed, 06 Nov 2019 00:09:33 GMT

admin user, happens on any index, yes I have filed a case! thanks

Re: Blank screen instead of raw data

D2SI — Wed, 06 Nov 2019 00:12:27 GMT

Interesting, let me check on that!

Screenshots are tiny I know but it's the last 15 min not months 🙂

And yes, if I do any transforming command it works, I mean the 'Statistics' & 'Vizualisations' works, it just the raw data part that gets blank!

Thanks

Re: Blank screen instead of raw data

woodcock — Wed, 06 Nov 2019 00:25:53 GMT

MY BAD! Last 15 minutes should be fine (stupid tiny mobile phone screen).