Installation

Monitoring Console: Why the Indexes and Volumes>volume_detail_instance,the page has no data to display?

chenliying
Explorer

   When I click the Indexes and Volumes>volume_detail_instance,the page has no data to display,and it tips 'Search is waiting to type'. Anyone who can help me solve this problem,thanks.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Index volumes are a Splunk concept, not specific to Windows or Linux.  They make it easier for several indexes to share the same storage space.  For instance, instead of specifying a size limit for each index you give one size limit (perhaps the disk size minus some margin) for all of them.  Before we had volumes, each index would be assigned some fraction of the available disk space and the admin would have to hope he guessed right about how much each index needed.

You can read more about index volumes in $SPLUNK_HOME/etc/system/README/indexes.conf.spec and at https://docs.splunk.com/Documentation/Splunk/8.2.5/Indexer/Configureindexstoragesize

Don't, however, create volume(s) just to populate a dashboard that you otherwise don't need.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

A dashboard will display "Search is waiting for input" when undefined tokens are used in a panel.  If your system is like mine then you don't have any volumes defined and so the "Volume" dropdown will not populate, preventing the dashboard from running searches.

---
If this reply helps you, Karma would be appreciated.

chenliying
Explorer

Thank you very much,my system is windows,so how should I define volumes.I do not know so much about volumes of windows or linux.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Index volumes are a Splunk concept, not specific to Windows or Linux.  They make it easier for several indexes to share the same storage space.  For instance, instead of specifying a size limit for each index you give one size limit (perhaps the disk size minus some margin) for all of them.  Before we had volumes, each index would be assigned some fraction of the available disk space and the admin would have to hope he guessed right about how much each index needed.

You can read more about index volumes in $SPLUNK_HOME/etc/system/README/indexes.conf.spec and at https://docs.splunk.com/Documentation/Splunk/8.2.5/Indexer/Configureindexstoragesize

Don't, however, create volume(s) just to populate a dashboard that you otherwise don't need.

---
If this reply helps you, Karma would be appreciated.

chenliying
Explorer

It hleps me a lot,I will read the document carefully to know more about index storage.Thank you very much.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...