Monitoring Splunk

Show source is not loading for only one event

Splunk-Star
Loves-to-Learn Lots

Show source is not loading for only one event, getting "Failed to find target event in final sorted event list. Cannot properly prune results" after loading

Labels (1)
0 Karma

Splunk-Star
Loves-to-Learn Lots

Screenshot 2024-06-04 at 3.47.41 PM.png

0 Karma

Splunk-Star
Loves-to-Learn Lots

What ever you have mentioned thats correct, only for one log we are facing this issue, for others show source is loading fine.

still getting after truncating :

Failed to find target event in final sorted event list. Cannot properly prune results

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Splunk-Star,

could you share more infos, e.g. som screenshot?

Thank you.

Ciao.

Giuseppe

0 Karma

Splunk-Star
Loves-to-Learn Lots

Screenshot 2024-06-03 at 9.46.23 PM.png

 index = "*" "a39d0417-bc8e-41fd-ae1f-7ed5566caed6" "*uploadstat*" status=Processed

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Splunk-Star ,

Let me understand:

  • this is one of your events,
  • if you have many events, they are displayed,
  • if you have only one event, it isn't displayed,

is it correct?

have you this issue only with these logs or also with other logs?

Maybe the issue is related to the lenght of the log, I encountered an issue with very long logs, that were displayed with a very long delay for their dimension.

Did you tried to truncate it e.g. with substr:

index = "*" "a39d0417-bc8e-41fd-ae1f-7ed5566caed6" "*uploadstat*" status=Processed
| eval _raw=substr(_raw,100)

Ciao.

Giuseppe

 

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...