Splunk Search

All resource graphs empty

n5zap
Explorer

I installed SoS, enabled the collection scripts, and even though the scripts run fine and data is indexed, the resource utilization graphs all say "No results found." I suspect SoS has the wrong hostname in the query. The "instance to query" has the right machine name "voodoo", the data in the index has the name voodoo, the inputs.conf file has the name voodoo, and still there is no data in the graphs. The landing page for the app shows the server's name as "voodoo.viewkeeper.org" and I suspect it is querying under the FQDN instead of the short name, which is wrong. How do I fix the broken query?

Tags (1)
0 Karma

muebel
SplunkTrust
SplunkTrust

In the lower lefthand corner of the chart panel you'll find a magnifier glass icon that will take you to exactly what splunk is searching for in that case. You'll be able to determine if it is using the FQDN there.

If it is, you can look at the dashboard source config to find out why it's using the FQDN. It might be displaying the hostname in the instance dropdown, but that can be different from the token that actually gets passed to the chart search.

These type of issues involve tracing multiple parts of the config, this is just a starting point. Let me know how it goes.

0 Karma
Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...