Getting Data In

When any new data is uploaded to Splunk to review before index, why does the preview page comes up blank and no sample of data is generated?

mussab
Explorer

When I upload any new data to Splunk to review before the index, the preview page is blank and no sample of data is generated

Splunk Version: 7.1.2
Lab environment

0 Karma
1 Solution

mussab
Explorer

The issue has been fixed; when I checked the log files I noticed below error

08-18-2018 18:12:32.508 +0300 WARN CacheManager - Last run failed to evict requested bytes. Performing eviction in urgent mode for path=/opt/splunk/var/lib/splunk/audit/db

This error was due to the minimum space in index (I am using lab environment), I changed "Pause indexing if free disk space (in MB) falls below" setting under server setting to match my free space... and everything work fine now

View solution in original post

0 Karma

mussab
Explorer

The issue has been fixed; when I checked the log files I noticed below error

08-18-2018 18:12:32.508 +0300 WARN CacheManager - Last run failed to evict requested bytes. Performing eviction in urgent mode for path=/opt/splunk/var/lib/splunk/audit/db

This error was due to the minimum space in index (I am using lab environment), I changed "Pause indexing if free disk space (in MB) falls below" setting under server setting to match my free space... and everything work fine now

0 Karma

horsefez
SplunkTrust
SplunkTrust

@mussab please tell us more about the sample data you are using

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...