Splunk Search

Search screens not completing

rnadler
Engager

Env: Windows 2008 R2, Splunk 4.2.2

For the last month or so most of the Splunk search screens have not been completing -- they just hang. If you wait for a while and Finalize the search, the full results will appear. Same for reports. Even dashboard_live will say "Waiting for data..." on one or more panels until the page is refreshed.

Happens on all browsers (Chrome, FF, and IE).

Any idea what's going on?

Tags (1)
0 Karma

Drainy
Champion

Have a look at;

http://www.splunk.com/wiki/Community:PerformanceTroubleshooting

It sounds to me like you are encountering some performance issues with your install (although there may be something else going on).
If there was any information you gather using that link that you wanted to paste here to help troubleshoot then feel free to do so (being mindful of any sensitive information).

For some additional info,

  • are these realtime/run-once/scheduled searches?
  • Have you customized your install? E.g. do you use the default index or have you configured your own?
  • Is it just the single indexer for event log data or is it a main server for other forwarders/indexers, if so what sort of setup do you have?

Have a look through your jobs window in the top right to see if there are many jobs that are still running and see if their memory usage and time to complete seems excessive.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...