All Apps and Add-ons

Template for Citrix XenDesktop 7: Why does is the "User session detail" dashboard not populating results?

nzambo_splunk
Splunk Employee
Splunk Employee

Testing on 6.4 using XenDesktop 7.8. All of the dashboards seem to be populating properly except for "User session detail". Opening the panels in search yields results, but I can't figure out why the dashboard panels return no results.

alt text

alt text

0 Karma
1 Solution

nzambo_splunk
Splunk Employee
Splunk Employee

I made some modifications that resulted in the panels working. The only difference I found in the search job and the panel was that the pre-process searching were using the "search" command as part of the the SPL. The searches that were successful did not include that.

So, I modified the report to remove search from the pre-process SPL and everything started to populate.

Here's the updated report
http://pastebin.com/bzQCYR3L

View solution in original post

0 Karma

nspencer_splunk
Splunk Employee
Splunk Employee

Where does the file from http://pastebin.com/bzQCYR3L need to be placed in order for the dashboard to populate?

0 Karma

nzambo_splunk
Splunk Employee
Splunk Employee

Literally just replace the entire source of the User Session Detail dashboard. Open the dashboard, click edit source, paste this in. Done.

0 Karma

nzambo_splunk
Splunk Employee
Splunk Employee

I made some modifications that resulted in the panels working. The only difference I found in the search job and the panel was that the pre-process searching were using the "search" command as part of the the SPL. The searches that were successful did not include that.

So, I modified the report to remove search from the pre-process SPL and everything started to populate.

Here's the updated report
http://pastebin.com/bzQCYR3L

View solution in original post

0 Karma

vnguyen46
Contributor

I have all logs to the right indexes, but data still not populated. Your post seems invaluable if you can give more details on what you have done.
Thanks,

0 Karma

Spranta
Communicator

Amazing! Thank you very much!

0 Karma

jkat54
SplunkTrust
SplunkTrust

You can open activity -> jobs in one window and then open the dashboard in another window and monitor the searches that are started by the dashboard. Once they complete you can inspect each job and it's search.log to see what happened... maybe that will help.

nzambo_splunk
Splunk Employee
Splunk Employee

Yeah it's weird. The job/search is identical whether I use "open in search" from the failed panel, or compare to the job. Interestingly, clicking on the search from the jobs screen, I get no results. But, in that same window if I just re-submit the search it returns a result. logs appear to be all INFO except for a warning about my index master.

I appreciate the feedback, but no further really. I'll keep looking.

0 Karma

jkat54
SplunkTrust
SplunkTrust

so if you open the job in the job monitor / activity monitor and see it has 0 results, and then open the search.log for that job, do you see any clues there?

0 Karma

nzambo_splunk
Splunk Employee
Splunk Employee

I don't see any clues, but I also don't know exactly what I'd be looking for. The searches are identical. SPL is verbatim and like I said, as soon as I re-submit the search is returns results.

I feel like there's something re: dashboard pre/post processing with 6.4 because I'm having similar results with another app on 6.4 that works fine on 6.3.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!