I'm running Splunk 4.1.6 (89596) 64-bit on Windows 7. I'm using Chrome as my browser.
If I search on a sourcetype that has very large multi-line events (300 lines+) in an XML format. If I do a search on that sourcetype, it returns results. If I search on it again from the same Window, the search stops showing any progress indicator and never finishes. If I run the search a third time, Splunk says there are zero results.
But if I click on the Summary tab from the search app and click on that sourcetype, it displays the results properly.
Any idea how I can troubleshoot this?
Thx.
Craig
You should use a supported browser at first: Chrome and FF 3.6 are not supported right now.
I had great problems with Chrome too, so I now use FF or IE8.
When I run this search, Splunk generates like 10 GB of temp files and the search never finishes.
The total size of the XML source data is about 215 MB.
My search looks like this:
sourcetype="nvdb" score=* OR vuln_product=* | eval vuln_product=if(isnull(vuln_product),"N\A",vuln_product) | dedup cve_id | mvexpand vuln_product | rex field=vuln_product "(?i)(?P