Getting Data In

When any new data is uploaded to Splunk to review before index, why does the preview page comes up blank and no sample of data is generated?

mussab
Explorer

When I upload any new data to Splunk to review before the index, the preview page is blank and no sample of data is generated

Splunk Version: 7.1.2
Lab environment

0 Karma
1 Solution

mussab
Explorer

The issue has been fixed; when I checked the log files I noticed below error

08-18-2018 18:12:32.508 +0300 WARN CacheManager - Last run failed to evict requested bytes. Performing eviction in urgent mode for path=/opt/splunk/var/lib/splunk/audit/db

This error was due to the minimum space in index (I am using lab environment), I changed "Pause indexing if free disk space (in MB) falls below" setting under server setting to match my free space... and everything work fine now

View solution in original post

0 Karma

mussab
Explorer

The issue has been fixed; when I checked the log files I noticed below error

08-18-2018 18:12:32.508 +0300 WARN CacheManager - Last run failed to evict requested bytes. Performing eviction in urgent mode for path=/opt/splunk/var/lib/splunk/audit/db

This error was due to the minimum space in index (I am using lab environment), I changed "Pause indexing if free disk space (in MB) falls below" setting under server setting to match my free space... and everything work fine now

0 Karma

horsefez
SplunkTrust
SplunkTrust

@mussab please tell us more about the sample data you are using

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...