Hello All, I've build a dashboard with 5 time charts all using the same base search. It starts loading normally, but then halfway "hangs" and shows the error "An error occurred while fetching data". The search log shows no errors and reports a successful completion. When the event count is less everything works fine. But the problem is when we use the more events over time(like last 6 months). approximate events counts last 24hrs: 8K last 7 days: 60K last 30 days :300K   The Error is occurred in SH cluster only and not occurred in stand alone device(also please suggest the reason behind this). I have the similar issue as Click Here for similar question ... View more

Hello splunkers, Please help me to figure out this issue! I have a realtime alert which triggers an alert and send the email to users. when i ingest 62 files in splunk index, triggered alerts are 52 but i have received only 44 email notifications only. I figured out that the first email was received at 20:35 and 44th email at 20:40 and not received any further. I have also tried changing these two parameters of alert from there default value 5m, 1. action.email.maxtime-->1800 2. action.script.maxtime-->1800   splunk enterprise v6.6.3 Please help me if any other parameter is to be changed, or any known issue like this. ... View more

Hello splunkers, Please help me to resolve this issue. I have 39 csv files ingested into splunk in one go and iam expecting 27 alert email notifications. Everytime i am receiving 17 or 20 emails out of 27 triggered alerts and sometime i am receiving all the 27 emails as expected. Could you please help me how to resolve this issue. Is this issue related to the splunk or email server.?   splunk enterprise version 6.6.3 ... View more

Hello, I have a csv file generated by script daily at $SplunkHome\etc\apps\bin\'fuel_stations.csv'. I add manually that CSV file as Lookup table files using "settings> lookups> Lookup table files> add new" to use it for my splunk search |inputlookup fuel_station.csv. Now I want to automate to update lookup file whenever this csv file in above path is updated. How do I get the lookup table to update automatically whenever the CSV file is updated in the specific local file ? splunk v.6.6.3 Thanks ... View more

I have link switcher to filter the data ,when I am selecting any particular option, token for the same is passing in the query of maps+. query :index="indexA"|where TOTAL="$token$" |eval icon=if(Active=1,"building","car")| table latitude,longitude,icon,TOTAL here I am passing token when user click on any button(please check image), when I am switching from button "A" to button B the result of button "A" is also visible on MAP until I refresh the Dashboard(Using F5). Is there any way I can refresh this dashboard using some token or any other way. I have also tried SearchWhenChanged=True but it is not working for me . The same logic is working fine in Splunk 7.2.4 . Is this known issue for this version(splunk 6.6.3). Please help me to find solution for this. ... View more

Hello splunkers, I have report scheduled to run 0 minutes past every hour to generate the tabular results for last 60 minutes and send the email including the link to results. report has successfully sent the email (at 00:00,01:00,........,10:00, 11:00, 12:00.....23:00) If i access the link to results at 12:10 in the email that was generated at 10:00, i am able to see the latest results only (i.e., results generated at 12:00, even though i am clicking on the previous link). Can anyone please help me how can i check the results that are generated at that particular time range by clicking the link in respective email. ... View more