Monitoring Splunk

Strange behavior when searching on large events

jambajuice
Communicator

I'm running Splunk 4.1.6 (89596) 64-bit on Windows 7. I'm using Chrome as my browser.

If I search on a sourcetype that has very large multi-line events (300 lines+) in an XML format. If I do a search on that sourcetype, it returns results. If I search on it again from the same Window, the search stops showing any progress indicator and never finishes. If I run the search a third time, Splunk says there are zero results.

But if I click on the Summary tab from the search app and click on that sourcetype, it displays the results properly.

Any idea how I can troubleshoot this?

Thx.

Craig

Tags (1)

Paolo_Prigione
Builder

You should use a supported browser at first: Chrome and FF 3.6 are not supported right now.

I had great problems with Chrome too, so I now use FF or IE8.

0 Karma

jambajuice
Communicator

When I run this search, Splunk generates like 10 GB of temp files and the search never finishes.

0 Karma

jambajuice
Communicator

The total size of the XML source data is about 215 MB.

My search looks like this:

sourcetype="nvdb" score=* OR vuln_product=* | eval vuln_product=if(isnull(vuln_product),"N\A",vuln_product) | dedup cve_id | mvexpand vuln_product | rex field=vuln_product "(?i)(?P[^:]+):(?P[^:]+):(?P[^<]+)" | table cve_id,score,access_vector,access_complexity,authentication,integrity_impact,availability_impact,confidentiality_impact,vendor_name,product_name,version_name | outputlookup nvdb_database.csv

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...