Event: Show source loading ....

[chrisitanmoleck]

Hello,

if I try to show the source of an event, splunk shows only "loading ...".
I took care, that the result is finalized.

We are using Splunk 8.0.1.

Edit:
I start a search with "host=..." and time=last 24h
I open an event -> event actions -> show source (event.png)
Now the loading screen will not display any result/source, just "loading ...." (show-source.png)

[chrisitanmoleck]

Splunk support:
The Bug is solved on the next version that should be 8.0.2.
So the option would be to upgrade Splunk whenever this release comes out, we do not have an estimated date at the moment.

[chrisitanmoleck]

After updating to 8.0.2, the problem is solved!

[niketn]

@chrisitanmolecki would it be possible for you to elaborate your issue? How, where and what is the issue? If possible please attach screenshots.

[las]

We see the exact same problem also on 8.0.1
@chrisitanmolecki have you opened a case with support?

[las]

We are using windows Server 2016, that might have an impact

[chrisitanmoleck]

@las
We are using Suse Linux Enterprise Server 12 Sp4

[niketn]

So if both of you have same issue, even though I am not able to re-produce, this still seems like a bug. Work with Splunk Support! Do let us know the outcome.

[chrisitanmoleck]

@niketnilay
OK I will contact the support.
Cheers mate

[chrisitanmoleck]

@las No we haven't.

[niketn]

@chrisitanmolecki I tried the same and I was able to see the raw data under Show Source. I am also on 8.0.1. I had tried index=_internal host=*.

What is the exact query you have run?
Also how many events did you have?
Did you click on Show Source after you had pulled all the events?
Have you tried with index= and searching with shorter duration or may be with | head 1 to see Show Source works for you?
How about changing browsers to test?

[chrisitanmoleck]

@niketnilay

index=_internal host=* 

Not working

What is the exact query you have run?

host=foo

The issue occurs at every host

Also how many events did you have?
Thats very different. From a few to several thousands.

Did you click on Show Source after you had pulled all the events?
No I pulled at out just one event

Have you tried with index= and searching with shorter duration or may be with | head 1 to see Show Source works for you?
That change nothing

How about changing browsers to test?
Same at IE11, FF65.0 and GC78.0

[chrisitanmoleck]

@niketnilay Now it should be more expressive