Splunk® Enterprise

Analytics Workspace

Acrobat logo Download manual as PDF


Splunk Enterprise version 8.2 is no longer supported as of September 30, 2023. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
Acrobat logo Download topic as PDF

Troubleshoot the Analytics Workspace

You might encounter the following issues while using the Analytics Workspace.

Metrics do not appear in the Data panel

No metrics data sources appear in the Data panel.

Diagnosis

The following issues can cause metrics to not appear in the Data panel:

  • No metrics with timestamps in the past 24 hours are available.
  • The technical add-ons and agents you use to send and ingest metrics malfunctioned.

Solution

  1. Verify that Splunk Web ingested no metrics with timestamps in the past 24 hours.
  2. (Optional) Expand the time range for ingested metrics by modifying the earliest parameter in the metadata stanza located in the app's workspace.conf file. Expanding the time range for ingested metrics might have a negative impact on performance.
  3. Run the following search in the Search & Reporting app to verify that Splunk software is properly fetching metrics data:

    | mcatalog values(metric_name) as metrics WHERE NOT ("_dims"="rollup_aggregate" OR "_dims"="rollup_span" OR "_dims"="rollup_source_index") AND ("index"="*" OR "index"="_*" ) earliest=-1d BY index | mvexpand metrics limit=20000

    The search results match the list of metric names in the Analytics Workspace Data panel.
  4. Investigate whether the technical add-ons and agents you use to ingest metrics are functioning properly.

Data panel does not contain datasets

No datasets are listed in the Data panel.

Diagnosis

Datasets are not accelerated.

Solution

  1. Verify that the dataset is shared with you.
  2. Click the Datasets tab on the Splunk Enterprise Search & Reporting navigation bar.
  3. Check whether the dataset is accelerated. Accelerated datasets are designated by the lightning bolt (This screen image shows the accelerated dataset icon.) icon.

For more information, see Accelerate data models in the Knowledge Manager Manual.

Chart does not contain data

You are able to select a data source, but no data appears on the chart.

Diagnosis

The following conditions are possible causes of this issue:

  • There is no data within your selected time range.
  • There is no data using your selected filters.
  • You do not have access to the underlying index for the data.

Solution

  1. Expand the time range to view a wider range of data.
  2. In the Analysis Panel of the Analytics Workspace, adjust the filters to include a wider range of values.
  3. Contact your administrator to verify your permissions.

For more information about Analytics Workspace permissions and capabilities, see Requirements for the Analytics Workspace.

Some metrics are not shown or are missing from the Data panel

Some metrics are not shown or are missing from the list of available data sources in the Data panel.

Diagnosis

The maximum number of metrics that can be displayed in the Data panel is defined by max_metrics in workspace.conf. If the number of metrics exceeds this limit, an error message is shown.

This screen image shows the error message that is displayed if you exceed the maximum number of metrics.

Solution

Increase the limit for the maximum number of metrics that can be displayed in the Data panel:

  1. Edit the following stanza in workspace.conf and increase the value for max_metrics:
    [metadata]
    max_metrics = 30000
    
  2. Restart Splunk.
Last modified on 11 February, 2022
PREVIOUS
Creating a dashboard in the Analytics Workspace
 

This documentation applies to the following versions of Splunk® Enterprise: 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.2.0, 9.2.1


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters