Splunk Search

Splunkweb intermittently displays empty result rows in the search events view

Ellen
Splunk Employee
Splunk Employee

In 4.3 the search flashtime, sometimes the same query will return a full set of result rows in the events list but other times it will not.

In the UI if I navigate to subsequent pages for my search results, I will only see the indexed timestamps on the left but the data rows are empty.

If I select the table view, I can see the raw data is there. So this is not a data issue.

This intermittent display issue can happen on any search and I have even seen it on Splunk's standard "Errors in the last 24 hours" query.

Tags (3)
1 Solution

Ellen
Splunk Employee
Splunk Employee

This is a known issue reported under SPL-49330.

View solution in original post

Ellen
Splunk Employee
Splunk Employee

This is a known issue reported under SPL-49330.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...