About Armando

Armando · ‎09-23-2021

I'm having the same issue but only when the pie chart has a single field to group by. For example if I have a pie chart that shows counts by host and the search only yields a single host, the PDF will not show the pie chart visual. The dashboard will display the pie chart just fine, but the PDF will not. Not sure if this is a bug or if there's anyway to work around this issue.

Armando · ‎08-18-2020

Does your Splunk box where the input lives have Python 2 installed? I had to manually install it on my CentOS 8 box as the default for that distro is Python 3. Also, did you make any other changes besides what was outlined? If you did, I'd recommend removing and reinstalling the MSCS app and rebooting Splunk after making the Python changes. That's what ended up working for me.

Armando · ‎08-07-2020

Yeah. I had to manually install Python2 because CentOS 8 doesn't appear to have it by default. Other than that, config seems to be working as intended. I was able to bring in storage table data containing Windows Event logs from VMs. I'm currently working on formatting that data to fit the syntax that the Windows TA uses to parse fields out, etc.

Armando · ‎08-04-2020

I tried what you said and so far so good! I haven't really had a chance to create the necessary configuration on the Azure side, but the error within Splunk cleared. I'll report back tomorrow once I've had a chance to do the Azure end of the deal. Thanks!

Armando · ‎08-04-2020

Would you be able to be more specific with your solution (version, source of app package, etc.)? I'm having the same issue described by OP as of 8/4/2020. I've tried installing from Splunk Web and by manually copying the app folder to the appropriate Splunk directory. Neither one of those worked.

Armando · ‎07-02-2020

This issue was caused by my own doing. The new fields I added were created as required. I believe the reason it seemed to work OK at first must be that all my initially sampled events just so happened to all include those new required fields. Fields were deleted, recreated as optional, and the data model summary has been rebuilt. Everything is working as intended now.

Armando · ‎06-24-2020

My Network_Traffic data model was working just fine this morning. I stopped the acceleration so that I could add more fields to the All_Traffic data set. It seems that after I did that, it no longer captures any events. I even tried replacing the original constraint of "(`cim_Network_Traffic_indexes`) tag=network tag=communicate" with "index=*" and I still don't get any events during the preview. I tried rebuilding the summaries and that didn't seem to fix the issue. I've also restarted the Splunk Enterprise instance and the server itself with no luck. Lastly, I cloned the data model just for fun but I still get the same behavior. Has anyone experienced this? If so, were you able to resolve the issue?

Posts	7
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎06-24-2020

Online Status	Offline
Date Last Visited	‎09-23-2021 11:35 PM

Data Model Does Not Show Any Events

Re: Pie chart not showing up when exporting as PDF

Re: Unable to initialize modular input "mscs_stora...

Re: Unable to initialize modular input "mscs_stora...

Re: Unable to initialize modular input "mscs_stora...

Re: Unable to initialize modular input "mscs_stora...

Re: Data Model Does Not Show Any Events

Data Model Does Not Show Any Events