Dashboards & Visualizations

Why am I experiencing inconsistent ingestion?


Hello pls I have a problem with a search.

if I run this search, it has inconsistent ingestion. Here is the search I ran:


if I put a time range of 60mins even 7days, I do not see results. But if I put 30days, I have like million events populated.

Here is the error message I got from Splunk.:

configuration for xyz/123/xxx/ took longer time than expected. This usually indicate problem with underlying storage performance. 

can someone help me if you had similar experience. Thanks 

Labels (1)
0 Karma



probably you have some issues to get data in? 
If you have MC, you could check there if there are missing forwarders etc.

Another way is check if that index contains data like

| tstats prestats=t count where index=compare_items by _time, host span=1d
| timechart span=1d count by host

Then select different time frame for it. That should show when events has stopped to come into splunk. Then just look from UF (host on previous query) side have there happened anything. 

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...