ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.

XCOM integration with Splunk dashboard shows "Could not create search"


Article ID: 226333


Updated On:


XCOM Data Transport XCOM Data Transport - Windows XCOM Data Transport - Linux PC


Followed steps to integrate XCOM for Windows with Splunk:
CA XCOM™ Data Transport® for Windows 11.6 Service Packs > Administrating > Splunk®Dashboard Samples

However, after executing some transfers the "Overall Summary" dashboard shows "Could not create search":


After checking Splunk log file "C:\Program Files\Splunk\var\log\splunk\splunkd.log" the root cause was found:
10-14-2021 16:42:19.276 +1100 ERROR AlertsManager - Search not executed: The minimum free disk space (5000MB) reached for C:\Program Files\Splunk\var\run\splunk\dispatch. user=admin., concurrency_category="historical", concurrency_context="user_instance-wide", current_concurrency=0, concurrency_limit=5000

The server had less than 5GB of free space on C: drive


Release : 11.6

Component : CA XCOM Data Transport for Windows


Increased free space to > 5GB and the search results were returned (no need to restart Splunk Windows service):