Show source is not loading for only one event

[Splunk-Star]

Show source is not loading for only one event, getting "Failed to find target event in final sorted event list. Cannot properly prune results" after loading

[Splunk-Star]

Screenshot 2024-06-04 at 3.47.41 PM.png

 

[Splunk-Star]

What ever you have mentioned thats correct, only for one log we are facing this issue, for others show source is loading fine.

still getting after truncating :

Failed to find target event in final sorted event list. Cannot properly prune results

[gcusello]

Hi @Splunk-Star,

could you share more infos, e.g. som screenshot?

Thank you.

Ciao.

Giuseppe

[Splunk-Star]

Screenshot 2024-06-03 at 9.46.23 PM.png

 index = "*" "a39d0417-bc8e-41fd-ae1f-7ed5566caed6" "*uploadstat*" status=Processed

[gcusello]

Hi @Splunk-Star ,

Let me understand:

• this is one of your events,
• if you have many events, they are displayed,
• if you have only one event, it isn't displayed,

is it correct?

have you this issue only with these logs or also with other logs?

Maybe the issue is related to the lenght of the log, I encountered an issue with very long logs, that were displayed with a very long delay for their dimension.

Did you tried to truncate it e.g. with substr:

index = "*" "a39d0417-bc8e-41fd-ae1f-7ed5566caed6" "*uploadstat*" status=Processed
| eval _raw=substr(_raw,100)

Ciao.

Giuseppe