- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have upgraded splunk to splunk version 4.3 but I am not seeing Data preview option as in this
http://docs.splunk.com/Documentation/Splunk/4.3/Data/Overviewofdatapreview
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Also, take a look at this Answer for this.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Also, take a look at this Answer for this.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I was able to get this working with the help of Splunk Support. it's a known issue with the splunk_datapreview app and search head pooling (shp).
here's the work around:
- go to one of your search heads, find the splunk_datapreview app (should be in $SPLUNK_HOME/etc/apps) and copy it to my seach head pool share's etc/apps/
- restart each search head
after i performed the work around the data preview screen did appear as expected when i used the Add Data dialogs.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I've updated the relevant upgrade and troubleshooting topics in the Distributed Deployment Manual to make this point more clear: "Caution: The migration utility warns you of apps that need to be copied to shared storage for pooled search heads when you upgrade them. It does not, however, copy them for you. You must manually copy all updated apps - including apps that ship with Splunk (such as the Search app and Data Preview) - to shared storage during the upgrade process. Failure to do so can cause problems with Splunk's user interface after the upgrade is complete."
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In the Manager->Data inputs just click on new Files and directories and you will be presented with it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
that is correct, ChrisG. I did not get the wizard. turns out it's a bug, see my answer below
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So, just to be clear: when you click Add Data and choose the type of data you want to add, you don't see a wizard page that gives you the choice to "Preview data before indexing" or "Skip preview?"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
upgraded to 4.3.2 (build 123586) and I also do not see the data preview option. IIRC we started on splunk 4.1 and have upgraded over time.
