Search is waiting for input ERROR

[harshparikhxlrd]

Hello,

I'm having issues with some of my splunk dashboards having issues with loading. It was loading fine before, but sometimes it takes 5 minutes just to load the data or sometimes just won't load at all. I figured it was maybe a splunk back end issue. From what I've looked at, it may be a regex/token error.

[martynoconnor]

Are all of your tokens populated? You'll get that error if a dashboard panel expects token input and the token isn't set.

[harshparikhxlrd]

Yeah, when I took a look, they all were populated.

[martynoconnor]

Hmm, have you tried navigating away from the dashboard and then going back to it? I have seen intermittent random errors like this before.

[harshparikhxlrd]

Yes. Sometimes it loads the dashboards properly. But it isn't consistent. Sometimes as I stated before, can take up to 5 minutes to load or just WAIT for search to load forever. Other times, I will get that one Splunk error with the horse.

[martynoconnor]

Hmm, if you're getting the Pony, there's usually something more fundamental at play. That normally occurs when there are incompatible apps installed, or an app requires another but that's not installed, or not the right version. I've seen that most commonly with Splunk App for Windows Infrastructure and the Windows TA/MSAD TA/DNS TA.

[martynoconnor]

What version of Splunk is this on?

[harshparikhxlrd]

Splunk Enterprise on the cloud. I'm not sure what version number, but that's what I'm using