Splunk Enterprise Security

Can you help me figure out why my Splunk 7.2.0 & Enterprise Security 5.1.1 are returning a "Search waiting for input" error?

ZimmermanC1
Explorer

After updating our Splunk environment from Splunk 7.0.3 & ES 5.0 to Splunk 7.2.0 & Enterprise Security 5.1.1, many of the ES dashboards are not functioning. This appears to be a problem with all ES dashboards that use a dropdown input or Field Picker that includes an ALL option.

For example: the Access Center dashboard should have 4 panels of data, however all 4 panels show the error “Search is waiting for input”. I have tried adjusting all of the input fields at the top of the dashboard and hitting search again but nothing changes.

ZimmermanC1
Explorer

We have not edited any of the ES dashboards. They remain completely stock. It feels like this is a bug.

0 Karma

felipesewaybric
Contributor

Oh, is one of the ES, ok, maybe some scheduled search is missing. But maybe is a bug in the dash.

Check the search to see what token is missing.

0 Karma

ZimmermanC1
Explorer

Turns out that we had made a few adjustments to some dashboards within ES. I cleared out the changes...which were very very minimal and all of the dashboards now work. It makes me wonder what changes to the base dashboards would have been broken due our changes.

0 Karma

felipesewaybric
Contributor

Most of the time, the search is waiting for a token. Maybe some input that wasn't selected or maybe some search didn´t return the data to be used in this search.

If you want to copy and paste the XML from the source here, I can have a look.

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...