Dashboards & Visualizations

how to solve the error message: an error ocured while fetching data in a splunk dashboard using post-process search?

sonila
Path Finder

Every time I run the dashboard this message appears and then splunk server goes down. Dashboard is based in a post-process search where the base searches are as scheduled reports. Why does this happens?

0 Karma

woodcock
Esteemed Legend

You need to make sure that the TTL ("Time To Live") of your scheduled search is at least as long as the periodicity of the search. If your search runs every day than the search's TTL should be at least 60*60*24 or greater. If not, you will get this error. You can check TTL like this:

|rest/servicesNS/-/-/saved/searches
| fields dispatch.ttl title eai:acl.app description search disabled triggered_alert_count actions action.script.filename alert.severity cron_schedule

https://www.splunk.com/blog/2012/09/12/how-long-does-my-search-live-default-search-ttl/

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!