- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When I upload any new data to Splunk to review before the index, the preview page is blank and no sample of data is generated
Splunk Version: 7.1.2
Lab environment
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The issue has been fixed; when I checked the log files I noticed below error
08-18-2018 18:12:32.508 +0300 WARN CacheManager - Last run failed to evict requested bytes. Performing eviction in urgent mode for path=/opt/splunk/var/lib/splunk/audit/db
This error was due to the minimum space in index (I am using lab environment), I changed "Pause indexing if free disk space (in MB) falls below" setting under server setting to match my free space... and everything work fine now
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The issue has been fixed; when I checked the log files I noticed below error
08-18-2018 18:12:32.508 +0300 WARN CacheManager - Last run failed to evict requested bytes. Performing eviction in urgent mode for path=/opt/splunk/var/lib/splunk/audit/db
This error was due to the minimum space in index (I am using lab environment), I changed "Pause indexing if free disk space (in MB) falls below" setting under server setting to match my free space... and everything work fine now
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@mussab please tell us more about the sample data you are using
