Installation

Monitoring Console: Why the Indexes and Volumes>volume_detail_instance,the page has no data to display?

chenliying
Explorer

   When I click the Indexes and Volumes>volume_detail_instance,the page has no data to display,and it tips 'Search is waiting to type'. Anyone who can help me solve this problem,thanks.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Index volumes are a Splunk concept, not specific to Windows or Linux.  They make it easier for several indexes to share the same storage space.  For instance, instead of specifying a size limit for each index you give one size limit (perhaps the disk size minus some margin) for all of them.  Before we had volumes, each index would be assigned some fraction of the available disk space and the admin would have to hope he guessed right about how much each index needed.

You can read more about index volumes in $SPLUNK_HOME/etc/system/README/indexes.conf.spec and at https://docs.splunk.com/Documentation/Splunk/8.2.5/Indexer/Configureindexstoragesize

Don't, however, create volume(s) just to populate a dashboard that you otherwise don't need.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

A dashboard will display "Search is waiting for input" when undefined tokens are used in a panel.  If your system is like mine then you don't have any volumes defined and so the "Volume" dropdown will not populate, preventing the dashboard from running searches.

---
If this reply helps you, an upvote would be appreciated.

chenliying
Explorer

Thank you very much,my system is windows,so how should I define volumes.I do not know so much about volumes of windows or linux.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Index volumes are a Splunk concept, not specific to Windows or Linux.  They make it easier for several indexes to share the same storage space.  For instance, instead of specifying a size limit for each index you give one size limit (perhaps the disk size minus some margin) for all of them.  Before we had volumes, each index would be assigned some fraction of the available disk space and the admin would have to hope he guessed right about how much each index needed.

You can read more about index volumes in $SPLUNK_HOME/etc/system/README/indexes.conf.spec and at https://docs.splunk.com/Documentation/Splunk/8.2.5/Indexer/Configureindexstoragesize

Don't, however, create volume(s) just to populate a dashboard that you otherwise don't need.

---
If this reply helps you, an upvote would be appreciated.

chenliying
Explorer

It hleps me a lot,I will read the document carefully to know more about index storage.Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...