topic Issue at selection with Time Range picker in Splunk Search

Issue at selection with Time Range picker

krusty — Thu, 19 Jul 2018 09:40:27 GMT

Hi,

we use in our environment (indexer cluster, searchhaed/deployment server) Splunk enterprise version 7.1.1.
If we do a search like this

index="test" host="testserver" | sort 0 _time

Over the last 7 days we are not able to show only some events which we select with the time range picker.

Does anybody know why this issue only appears if we use

| sort 0 _time

in our search? If we do not use this, we are able to pick a time range from the picker.
But then the events are not sorted and not really usable.

Re: Issue at selection with Time Range picker

HiroshiSatoh — Thu, 19 Jul 2018 12:29:12 GMT

Is not shortage of resources?
Has an error been output(search.log)?
What happens when you narrow down the fields?

index="test" host="testserver" |fields _time,(fields you use)| sort 0 _time

Re: Issue at selection with Time Range picker

krusty — Fri, 20 Jul 2018 13:34:12 GMT

No error is been reported in any logfile.

If I use

index="test" host="testserver*" 
|  fields _time, raw 
| sort 0 _time

in the search field and search for the last 7 days. I got 10434 events. Then I choose a timeframe from the time picker and at the bottom of the page I didn't see any events, but the page show below the search field that I selected 394 events.

Unfortunately I couldn't upload an example, otherwise you could see what I mean.

Re: Issue at selection with Time Range picker

HiroshiSatoh — Fri, 20 Jul 2018 17:32:22 GMT

About 10,000 things will not result in memory shortage. 394 cases are not displayed but are the correct number of cases?

It does not reproduce in my environment. Check the search.log and check warnings and errors.