Reporting

Pivot failing to load data unless accelerated?

pj
Contributor

I have been having issues with the Pivot table failing to load, when an underlying data model seemingly has a number of attributes added to it.

For example, I created a new data model with a Root Event Object Type and the following Object Constraints:

index=_internal sourcetype=splunkd

If I do nothing further, I am able to pivot off this fine. However, if I go back into the data model manager and select to add all the auto-extracted fields, then go try pivoting off it, I get 0 results and an error in the Pivot tool.

The search job has failed due to an
error. You may be able view the job in
the Job Inspector. Job Terminated
Unexpectedly.

If I then select to 'Open in Search' from the Pivot GUI, then the data loads absolutely fine using the | pivot command. This same situation happens for other data like access_combined.

Here is the odd part - If I select to accelerate the model, then the pivot tool renders the data without any errors...

I have another model under acceleration, that additionally has a Root Transaction Event Type and when trying to load this (even tho working in preview), I get this error:

Error in 'TSCollectProcessor': Failed
to create TSIDX event in
namespace='/opt/splunk/var/run/splunk/dispatch/1399297255.111/tsidxstats'
errcode=1

Again, the above works when opening in search and viewing the underlying pivot search.

I am running this on a Amazon Linux AMI.

0 Karma
1 Solution

pj
Contributor

This turned out to be a lack of memory on the server... Increasing the memory fixed the issue. Interestingly, I guess that also means accelerated data models use less memory.

View solution in original post

0 Karma

pj
Contributor

This turned out to be a lack of memory on the server... Increasing the memory fixed the issue. Interestingly, I guess that also means accelerated data models use less memory.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...