Search screens not completing

[rnadler]

Env: Windows 2008 R2, Splunk 4.2.2

For the last month or so most of the Splunk search screens have not been completing -- they just hang. If you wait for a while and Finalize the search, the full results will appear. Same for reports. Even dashboard_live will say "Waiting for data..." on one or more panels until the page is refreshed.

Happens on all browsers (Chrome, FF, and IE).

Any idea what's going on?

[Drainy]

Have a look at;

http://www.splunk.com/wiki/Community:PerformanceTroubleshooting

It sounds to me like you are encountering some performance issues with your install (although there may be something else going on).
If there was any information you gather using that link that you wanted to paste here to help troubleshoot then feel free to do so (being mindful of any sensitive information).

For some additional info,

• are these realtime/run-once/scheduled searches?
• Have you customized your install? E.g. do you use the default index or have you configured your own?
• Is it just the single indexer for event log data or is it a main server for other forwarders/indexers, if so what sort of setup do you have?

Have a look through your jobs window in the top right to see if there are many jobs that are still running and see if their memory usage and time to complete seems excessive.