Troubleshoot the Splunk Metrics Workspace
You might encounter the following issues while using the Splunk Metrics Workspace.
Error message on app setup page
After downloading and installing the Splunk Metrics Workspace, you cannot open the application. You see a message prompting you to upgrade Splunk Enterprise.
You are running an unsupported version of Splunk Enterprise. The Splunk Metrics Workspace requires Splunk Enterprise version 7.1 or later.
Upgrade to a supported version of Splunk Enterprise. For more information, see How to upgrade Splunk Enterprise in the Installation Manual.
Metrics do not appear in the Data panel
No metrics data sources appear in the Data panel.
The following issues can cause metrics to not appear in the Data panel:
- No metrics with timestamps in the past 24 hours are available.
- The technical add-ons and agents you use to send and ingest metrics malfunctioned.
- Verify that Splunk Web ingested no metrics with timestamps in the past 24 hours.
- (Optional) Expand the time range for ingested metrics by modifying the
earliestparameter in the
metadatastanza located in the app's
workspace.conffile. Expanding the time range for ingested metrics might have a negative impact on performance.
- Run the following search in the Search & Reporting app to verify that Splunk software is properly fetching metrics data:
The search results match the list of metric names in the Metrics Workspace Data panel.
| mcatalog values(metric_name) as metrics WHERE NOT ("_dims"="rollup_aggregate" OR "_dims"="rollup_span" OR "_dims"="rollup_source_index") AND ("index"="*" OR "index"="_*" ) earliest=-1d BY index | mvexpand metrics limit=20000
- Investigate whether the technical add-ons and agents you use to ingest metrics are functioning properly.
Data panel does not contain datasets
No datasets are listed in the Data panel.
Datasets are not accelerated.
- Verify that the dataset is shared with you.
- Click the Datasets tab on the Splunk Enterprise Search & Reporting navigation bar.
- Check whether the dataset is accelerated. Accelerated datasets are designated by the lightning bolt () icon.
For more information, see Accelerate data models in the Knowledge Manager Manual.
Chart does not contain data
You are able to select a data source, but no data appears on the chart.
The following conditions are possible causes of this issue:
- There is no data within your selected time range.
- There is no data using your selected filters.
- You do not have access to the underlying index for the data.
- Expand the time range to view a wider range of data.
- In the Analysis Panel of the Metrics Workspace, adjust the filters to include a wider range of values.
- Contact your administrator to verify your permissions.
For more information about Metrics Workspace permissions and capabilities, see Hardware and software requirements for the Splunk Metrics Workspace.
Some metrics are not shown or are missing from the Data panel
Some metrics are not shown or are missing from the list of available data sources in the Data panel.
The maximum number of metrics that can be displayed in the Data panel is defined by
workspace.conf. If the number of metrics exceeds this limit, an error message is shown.
Increase the limit for the maximum number of metrics that can be displayed in the Data panel:
- Edit the following stanza in
workspace.confand increase the value for
[metadata] max_metrics = 30000
- Restart Splunk.
Hardware and software requirements for the Splunk Metrics Workspace
Share data in the Splunk Metrics Workspace
This documentation applies to the following versions of Splunk® Metrics Workspace (Legacy): 1.1.6, 1.1.7, 1.1.9