Splunk Search

Splunkweb intermittently displays empty result rows in the search events view

Ellen
Splunk Employee
Splunk Employee

In 4.3 the search flashtime, sometimes the same query will return a full set of result rows in the events list but other times it will not.

In the UI if I navigate to subsequent pages for my search results, I will only see the indexed timestamps on the left but the data rows are empty.

If I select the table view, I can see the raw data is there. So this is not a data issue.

This intermittent display issue can happen on any search and I have even seen it on Splunk's standard "Errors in the last 24 hours" query.

Tags (3)
1 Solution

Ellen
Splunk Employee
Splunk Employee

This is a known issue reported under SPL-49330.

View solution in original post

Ellen
Splunk Employee
Splunk Employee

This is a known issue reported under SPL-49330.

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...