Getting Data In

When any new data is uploaded to Splunk to review before index, why does the preview page comes up blank and no sample of data is generated?

mussab
Explorer

When I upload any new data to Splunk to review before the index, the preview page is blank and no sample of data is generated

Splunk Version: 7.1.2
Lab environment

0 Karma
1 Solution

mussab
Explorer

The issue has been fixed; when I checked the log files I noticed below error

08-18-2018 18:12:32.508 +0300 WARN CacheManager - Last run failed to evict requested bytes. Performing eviction in urgent mode for path=/opt/splunk/var/lib/splunk/audit/db

This error was due to the minimum space in index (I am using lab environment), I changed "Pause indexing if free disk space (in MB) falls below" setting under server setting to match my free space... and everything work fine now

View solution in original post

0 Karma

mussab
Explorer

The issue has been fixed; when I checked the log files I noticed below error

08-18-2018 18:12:32.508 +0300 WARN CacheManager - Last run failed to evict requested bytes. Performing eviction in urgent mode for path=/opt/splunk/var/lib/splunk/audit/db

This error was due to the minimum space in index (I am using lab environment), I changed "Pause indexing if free disk space (in MB) falls below" setting under server setting to match my free space... and everything work fine now

0 Karma

horsefez
SplunkTrust
SplunkTrust

@mussab please tell us more about the sample data you are using

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...