Splunk Web doesn't show the events at times. If I restart and log in, it will show the events, but after some time, events are not displayed. It shows total events, but the details are not displayed
Also, the main page doesn't show the summary of events indexed. Usually it should total events and indexes.
What could be the problem? This leads to me restarting splunkd service every time.
There's also a possible chance of exceeding truncate value and browser will not be able to render and support UI, check length of your _raw event using <your search query>| eval len=len(_raw) and view field len under interesting fields.
This is real pain. sometime logs are coming and most of the time same query/index does not show any result. Since we are using this across enterprise, it's not possible to restart or play around with this tool. Not happy with splunk. Need to time to think of another solution.
Wat browser you are using.?
I guess tat should be supported by Splunk. If you are not getting internal logs.there should be a problem with your browser. Use chrome or mozilla
i am using chrome only.
index=_internal error this is returning error but there is no output to the head 1| table _raw output for my own query. sorry for the confusion
if you see the number of results counter, but no events displayed in the panel, this may be a UI rendering issue.
Maybe some events contain characters that breaks the display.
Do you see results if you use a stats command or a chart ?
And try to look for a different set of events.
I have some users that complain about the same issue. I had advised them to clear their cache, tried different web browsers, nothing works for them. Similar to the screenshot in the post, there is data in the timeline and the fields column display, but the events in the table do not show anything.
Trying to debug from the access logs and what I could find in Splunk internal logs, there is nothing out of the ordinary. HELP
My solution was go into the "All Fields" button on the left of the search results, change Coverage: From "All fields", to something smaller, and hit deselect all. Then run a simple search to make sure things are coming up, then go back and select just specific fields and everything starts to work. My best guess is that at some point - I had it select a huge number of fields, and doing these changes forces it to forget the huge list which fixes the issue.