Splunk Search

Search is waiting for input ERROR

harshparikhxlrd
Path Finder

Hello,

I'm having issues with some of my splunk dashboards having issues with loading. It was loading fine before, but sometimes it takes 5 minutes just to load the data or sometimes just won't load at all. I figured it was maybe a splunk back end issue. From what I've looked at, it may be a regex/token error.

martynoconnor
Communicator

Are all of your tokens populated? You'll get that error if a dashboard panel expects token input and the token isn't set.

0 Karma

harshparikhxlrd
Path Finder

Yeah, when I took a look, they all were populated.

0 Karma

martynoconnor
Communicator

Hmm, have you tried navigating away from the dashboard and then going back to it? I have seen intermittent random errors like this before.

0 Karma

harshparikhxlrd
Path Finder

Yes. Sometimes it loads the dashboards properly. But it isn't consistent. Sometimes as I stated before, can take up to 5 minutes to load or just WAIT for search to load forever. Other times, I will get that one Splunk error with the horse.

0 Karma

martynoconnor
Communicator

Hmm, if you're getting the Pony, there's usually something more fundamental at play. That normally occurs when there are incompatible apps installed, or an app requires another but that's not installed, or not the right version. I've seen that most commonly with Splunk App for Windows Infrastructure and the Windows TA/MSAD TA/DNS TA.

0 Karma

martynoconnor
Communicator

What version of Splunk is this on?

0 Karma

harshparikhxlrd
Path Finder

Splunk Enterprise on the cloud. I'm not sure what version number, but that's what I'm using

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!