Splunk Search

Search is waiting for input ERROR

harshparikhxlrd
Path Finder

Hello,

I'm having issues with some of my splunk dashboards having issues with loading. It was loading fine before, but sometimes it takes 5 minutes just to load the data or sometimes just won't load at all. I figured it was maybe a splunk back end issue. From what I've looked at, it may be a regex/token error.

martynoconnor
Communicator

Are all of your tokens populated? You'll get that error if a dashboard panel expects token input and the token isn't set.

0 Karma

harshparikhxlrd
Path Finder

Yeah, when I took a look, they all were populated.

0 Karma

martynoconnor
Communicator

Hmm, have you tried navigating away from the dashboard and then going back to it? I have seen intermittent random errors like this before.

0 Karma

harshparikhxlrd
Path Finder

Yes. Sometimes it loads the dashboards properly. But it isn't consistent. Sometimes as I stated before, can take up to 5 minutes to load or just WAIT for search to load forever. Other times, I will get that one Splunk error with the horse.

0 Karma

martynoconnor
Communicator

Hmm, if you're getting the Pony, there's usually something more fundamental at play. That normally occurs when there are incompatible apps installed, or an app requires another but that's not installed, or not the right version. I've seen that most commonly with Splunk App for Windows Infrastructure and the Windows TA/MSAD TA/DNS TA.

0 Karma

martynoconnor
Communicator

What version of Splunk is this on?

0 Karma

harshparikhxlrd
Path Finder

Splunk Enterprise on the cloud. I'm not sure what version number, but that's what I'm using

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...