Reporting

embeded report shows only blank screen

seitnerm
Engager

Hi,

I have a problem with the embeded report function on splunk 7 instances.
we have multiple splunk servers at different customers. All of them are standalone splunk servers.
I have created an embeded report on all instances with the same search. The report only runs for a few second and if I export it as csv, I see on all of them results.
One of this instances have the version 6.6.1.
There the embed report function works as expected. I see the results in a table, if i open the link. Independent of the browser which I use.
But on all other instances (which are splunk 7.0.1 or 7.0.2), I only see a blank page if I open the link with firefox, chrome or opera.
If I open it with the internet explorer I see the results but in a column chart and not as table.

Has someone a idea what the problem might be?

Tags (1)

seitnerm
Engager

Sure, I tried a short query for suricata alerts:

index="suricata" event_type=alert
| stats count by alert.signature, severity
| table alert.signature, severity,count

0 Karma

p_gurav
Champion

Can you tell me query you are running?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...