Installation

Monitoring Console: Why the Indexes and Volumes>volume_detail_instance,the page has no data to display?

chenliying
Explorer

   When I click the Indexes and Volumes>volume_detail_instance,the page has no data to display,and it tips 'Search is waiting to type'. Anyone who can help me solve this problem,thanks.

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Index volumes are a Splunk concept, not specific to Windows or Linux.  They make it easier for several indexes to share the same storage space.  For instance, instead of specifying a size limit for each index you give one size limit (perhaps the disk size minus some margin) for all of them.  Before we had volumes, each index would be assigned some fraction of the available disk space and the admin would have to hope he guessed right about how much each index needed.

You can read more about index volumes in $SPLUNK_HOME/etc/system/README/indexes.conf.spec and at https://docs.splunk.com/Documentation/Splunk/8.2.5/Indexer/Configureindexstoragesize

Don't, however, create volume(s) just to populate a dashboard that you otherwise don't need.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

A dashboard will display "Search is waiting for input" when undefined tokens are used in a panel.  If your system is like mine then you don't have any volumes defined and so the "Volume" dropdown will not populate, preventing the dashboard from running searches.

---
If this reply helps you, Karma would be appreciated.

chenliying
Explorer

Thank you very much,my system is windows,so how should I define volumes.I do not know so much about volumes of windows or linux.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Index volumes are a Splunk concept, not specific to Windows or Linux.  They make it easier for several indexes to share the same storage space.  For instance, instead of specifying a size limit for each index you give one size limit (perhaps the disk size minus some margin) for all of them.  Before we had volumes, each index would be assigned some fraction of the available disk space and the admin would have to hope he guessed right about how much each index needed.

You can read more about index volumes in $SPLUNK_HOME/etc/system/README/indexes.conf.spec and at https://docs.splunk.com/Documentation/Splunk/8.2.5/Indexer/Configureindexstoragesize

Don't, however, create volume(s) just to populate a dashboard that you otherwise don't need.

---
If this reply helps you, Karma would be appreciated.

chenliying
Explorer

It hleps me a lot,I will read the document carefully to know more about index storage.Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...