topic Re: Why does Splunk Web sometimes not show the event data for a search unless I restart? in Splunk Search

Why does Splunk Web sometimes not show the event data for a search unless I restart?

boopaljothi — Sat, 09 Jan 2016 01:23:55 GMT

Splunk Web doesn't show the events at times. If I restart and log in, it will show the events, but after some time, events are not displayed. It shows total events, but the details are not displayed

Also, the main page doesn't show the summary of events indexed. Usually it should total events and indexes.

What could be the problem? This leads to me restarting splunkd service every time.

Re: Why does Splunk Web sometimes not show the event data for a search unless I restart?

sundareshr — Sat, 09 Jan 2016 16:40:59 GMT

What do you see in the splunk logs?

http://docs.splunk.com/Documentation/Splunk/6.2.0/Troubleshooting/WhatSplunklogsaboutitself

Re: Why does Splunk Web sometimes not show the event data for a search unless I restart?

boopaljothi — Sat, 09 Jan 2016 16:54:51 GMT

there are multiple logs in C:\Program Files\Splunk\var\log\splunk. is there any particular log that you are looking for?

Re: Why does Splunk Web sometimes not show the event data for a search unless I restart?

yannK — Sat, 09 Jan 2016 17:25:28 GMT

if you see the number of results counter, but no events displayed in the panel, this may be a UI rendering issue.
Maybe some events contain characters that breaks the display.

Do you see results if you use a stats command or a chart ?
Check for the javascript logs of your browser (developper tool on chrome by example)
And try to look for a different set of events.

Re: Why does Splunk Web sometimes not show the event data for a search unless I restart?

sundareshr — Sat, 09 Jan 2016 17:29:34 GMT

start with splunkd.... see if anything sticks out.

Re: Why does Splunk Web sometimes not show the event data for a search unless I restart?

boopaljothi — Sat, 09 Jan 2016 17:44:44 GMT

splunkd didnt show anything odd

Re: Why does Splunk Web sometimes not show the event data for a search unless I restart?

boopaljothi — Sat, 09 Jan 2016 17:47:30 GMT

i am searching all the events that i have which is just under 100. i did try with stats command but still nothing just count was displayed as before

Re: Why does Splunk Web sometimes not show the event data for a search unless I restart?

boopaljothi — Sat, 23 Jan 2016 06:03:57 GMT

any help here. this becoming too difficult

Re: Why does Splunk Web sometimes not show the event data for a search unless I restart?

boopaljothi — Tue, 26 Jan 2016 04:11:18 GMT

also i imported the tutorial data only and no other events are present. still i get same issue

Re: Why does Splunk Web sometimes not show the event data for a search unless I restart?

vasanthmss — Tue, 26 Jan 2016 04:25:36 GMT

... | table _raw
check Wats there. If your logs are json Splunk will take time to load... Post the screen shot

Re: Why does Splunk Web sometimes not show the event data for a search unless I restart?

boopaljothi — Tue, 26 Jan 2016 04:33:22 GMT

there is no output for this as well. i cant attach file here as of now

Re: Why does Splunk Web sometimes not show the event data for a search unless I restart?

vasanthmss — Tue, 26 Jan 2016 05:00:02 GMT

| head 1| table _raw

Check it.

index=_internal error

...
Wats the index and sourcetype it source you are using.Can you share the sample data

Re: Why does Splunk Web sometimes not show the event data for a search unless I restart?

boopaljothi — Tue, 26 Jan 2016 05:05:51 GMT

nope still no output

Re: Why does Splunk Web sometimes not show the event data for a search unless I restart?

vasanthmss — Tue, 26 Jan 2016 05:19:01 GMT

Wat browser you are using.?
I guess tat should be supported by Splunk. If you are not getting internal logs.there should be a problem with your browser. Use chrome or mozilla

Re: Why does Splunk Web sometimes not show the event data for a search unless I restart?

chimell — Tue, 26 Jan 2016 11:46:38 GMT

Hi boopaljothi
I advice you to use another browser to launch you search and wait a few minutes before concluding.

Re: Why does Splunk Web sometimes not show the event data for a search unless I restart?

boopaljothi — Tue, 26 Jan 2016 14:20:16 GMT

i am using chrome only.

index=_internal error this is returning error but there is no output to the head 1| table _raw output for my own query. sorry for the confusion

Re: Why does Splunk Web sometimes not show the event data for a search unless I restart?

boopaljothi — Tue, 26 Jan 2016 14:24:35 GMT

i used internet explorer latest version and it is working. may be an issue with chrome. i will update chrome and post the status here

Re: Why does Splunk Web sometimes not show the event data for a search unless I restart?

Ramesh_Yedurla — Tue, 26 Jan 2016 17:24:04 GMT

yes change the browser

Re: Why does Splunk Web sometimes not show the event data for a search unless I restart?

vasanthmss — Wed, 27 Jan 2016 08:44:01 GMT

Try with chrome

Re: Why does Splunk Web sometimes not show the event data for a search unless I restart?

ben_leung — Tue, 09 Aug 2016 23:48:11 GMT

I have some users that complain about the same issue. I had advised them to clear their cache, tried different web browsers, nothing works for them. Similar to the screenshot in the post, there is data in the timeline and the fields column display, but the events in the table do not show anything.

Trying to debug from the access logs and what I could find in Splunk internal logs, there is nothing out of the ordinary. HELP