Error on Dashboard new install

[jamlam]

Hi,

I've just installed Splunk and Splunk for Exchange and I'm very impressed with the app so far.

I'm having an issue with some of the searches, particularly on the Dashboard. I'm getting an error displayed at the top of the screen reading "Encountered an error while reading file '/opt/splunk/var/run/splunk/dispatchtmp/subsearch_1343037972.339_1343037973.341/prereport_0.csv.gz'"
and the Non-reporting servers and Hosts boxes are blank on screen. I'm getting a similar error on other screens that also have blank displays for certain searches. I've done some googling and drawn a blank, this is my first experience with Splunk so I'm not sure sure where else to start looking into this so I'd be grateful if someone could point me in the right direction!

Thanks
James

[MillerTime]

Upgrading Splunk to 4.3.4 should solve the issue

[Drainy · Accepted solution]

I assume you are running 4.3.3 ? This is a known issue with Splunk;

Subsearch failing with the error "Encountered an error while reading file '/opt/splunk/var/run/splunk/dispatchtmp/subsearch_*/prereport_*.csv.gz'.", the workaround is to format the fields with the command fields instead of table at the end of the sub search. (SPL-52862)

You could edit the dashboard searches so that instead of table it uses the word fields instead, if you aren't sure how to do this it would be best to contact support as they may have pre-built dashboards ready for this situation (or perhaps more info on an update to fix this)

[Drainy]

On the actual XML dashboards which are throwing this error you can edit the searches to use fields instead of table to workaround this until the next version

[michaeloleary]

Line 114 of a file? I'm slightly confused I'm trying to figure it where this line 114 is. Any help/clarification would be greatly appreciated.

[jamesklassen]

I got it fixed in the Exchange app by changing just line 114 to this:

(lastTime) as recent by host|join [search eventtype=msexchange-topology|eval host=lower(host)|fields host]|eval secs=now()-

[jamlam]

Further to that I've changed all the instances of table to fields and it's all working perfectly now!

[Drainy]

No worries. Feel free to click the tick next to the answer to accept too 🙂 If you wanted to fix it yourself it wouldn't be too difficult, you'd just need to figure out if the search strings are embedded in the dashboard or in a saved search. I suspect there are saved searches with post process searches in the dashboards but @ahall_splunk may chip in later with a better idea (or someone with some experience of the app!)

[jamlam]

Thanks for that, I'd seen the Known Issues list and thought it might be the same thing but this has confirmed it now! I'll give support a shout and see how I get on.

Thanks
James