Splunk Search

Search Dashboard: "What to Search", what query is executed?

mkelderm
Path Finder

What kind of search query is executed on the Search Dashboard on "What to Search"?

In my dashboard (search-head), I only see "Waiting for data...."

Marc

Tags (2)
1 Solution

mkelderm
Path Finder

The solution is that my users, even the admin user, did not search the internal indexes by default. I needed to change the /local/authorize.conf file

[role_my_role]
srchIndexesAllowed = *;_*
srchIndexesDefault = _*;main

Thanks to Mart Mueller For giving me the thoughts on the solution

View solution in original post

mkelderm
Path Finder

The solution is that my users, even the admin user, did not search the internal indexes by default. I needed to change the /local/authorize.conf file

[role_my_role]
srchIndexesAllowed = *;_*
srchIndexesDefault = _*;main

Thanks to Mart Mueller For giving me the thoughts on the solution

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

By looking at your job monitor you can tell it's running this:

| metadata type=sourcetypes | search totalCount > 0

In essence, it loads a list of sourcetypes along with number of events, earliest and latest times. From that some post processing is applied to create the total number of events, the overall earliest time, and the overall latest time.

If you see nothing that likely means there is no data in any index searched by default for your role.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Great.

For completeness' sake, mark this as answered and add your solution in another comment.

0 Karma

mkelderm
Path Finder

You triggered me on the issue, it is solved now

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

There's your problem then, as long as you get no results the search page won't display any.

Metadata works through distributed search. As for why it doesn't seem to work for you is hard to say from here.

0 Karma

mkelderm
Path Finder

On de SH as admin: no results
On the SP as admin: results

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

What happens when you run the query manually?

0 Karma

mkelderm
Path Finder

We do not see any data on this start page, while Splunk> is working fine. We can query etc. We are running on three servers, one search-head and 2 indexers.

0 Karma

mkelderm
Path Finder

Just de default search app, on Splunk 6.0:

http://myhost:8000/en-GB/app/search/search

0 Karma

somesoni2
Revered Legend

What is the name app/dashboard you are using? [in url, portions after <>/en-US/app...]

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.