All Apps and Add-ons

Template for Citrix XenDesktop 7: Why does is the "User session detail" dashboard not populating results?

Splunk Employee
Splunk Employee

Testing on 6.4 using XenDesktop 7.8. All of the dashboards seem to be populating properly except for "User session detail". Opening the panels in search yields results, but I can't figure out why the dashboard panels return no results.

alt text

alt text

0 Karma
1 Solution

Splunk Employee
Splunk Employee

I made some modifications that resulted in the panels working. The only difference I found in the search job and the panel was that the pre-process searching were using the "search" command as part of the the SPL. The searches that were successful did not include that.

So, I modified the report to remove search from the pre-process SPL and everything started to populate.

Here's the updated report
http://pastebin.com/bzQCYR3L

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Where does the file from http://pastebin.com/bzQCYR3L need to be placed in order for the dashboard to populate?

0 Karma

Splunk Employee
Splunk Employee

Literally just replace the entire source of the User Session Detail dashboard. Open the dashboard, click edit source, paste this in. Done.

0 Karma

Splunk Employee
Splunk Employee

I made some modifications that resulted in the panels working. The only difference I found in the search job and the panel was that the pre-process searching were using the "search" command as part of the the SPL. The searches that were successful did not include that.

So, I modified the report to remove search from the pre-process SPL and everything started to populate.

Here's the updated report
http://pastebin.com/bzQCYR3L

View solution in original post

0 Karma

Contributor

I have all logs to the right indexes, but data still not populated. Your post seems invaluable if you can give more details on what you have done.
Thanks,

0 Karma

Path Finder

Amazing! Thank you very much!

0 Karma

SplunkTrust
SplunkTrust

You can open activity -> jobs in one window and then open the dashboard in another window and monitor the searches that are started by the dashboard. Once they complete you can inspect each job and it's search.log to see what happened... maybe that will help.

Splunk Employee
Splunk Employee

Yeah it's weird. The job/search is identical whether I use "open in search" from the failed panel, or compare to the job. Interestingly, clicking on the search from the jobs screen, I get no results. But, in that same window if I just re-submit the search it returns a result. logs appear to be all INFO except for a warning about my index master.

I appreciate the feedback, but no further really. I'll keep looking.

0 Karma

SplunkTrust
SplunkTrust

so if you open the job in the job monitor / activity monitor and see it has 0 results, and then open the search.log for that job, do you see any clues there?

0 Karma

Splunk Employee
Splunk Employee

I don't see any clues, but I also don't know exactly what I'd be looking for. The searches are identical. SPL is verbatim and like I said, as soon as I re-submit the search is returns results.

I feel like there's something re: dashboard pre/post processing with 6.4 because I'm having similar results with another app on 6.4 that works fine on 6.3.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!