- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: Error fetching saved searches
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Error fetching saved searches
hi Splunkers,
I have a dashboard with refresh configured as 120, and most of the panels gets data from saved searches.
Eg:
<search ref="ReportName"></search>
I see "Error fetching saved searches" multiple times a day and for multiple panels.
I initially thought that the issue is with TTL configs for savedsearches, hence updated dispatch.ttl to 4p, and now can see that at any point of time, 4 results of these savedsearches are retained.
Any idea why the panels throws "Error fetching saved searches"?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, did you get a resolution for this issue? I have exactly the same problem,Hi, did you manage to resolve this issue? I have exactly the same problem....
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When the dashboard refresh, it will contact the captain to get the latest sid and then get the result from the local dispatch directory with the returned sid by captain. The problem seems to be caused by the intermittently failed of replicated search result to search head member.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, did you get a resolution to this issue? I have exactly the same problem
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi @RogerMay
No, I have raised a case with splunk support and they are still investigating.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Same here.
A browser refresh fixes the problem but not very useful since we have big TVs to monitor the dashboards.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
can you share the splunkd.log
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi @iamarkaprabha
I do not see any messages relevant in splunkd.log. I did a search for app name, dashboard name, panel name, saved search name but was not able to find anything useful.
Please let me know what component in splunkd I should be looking at?
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
