XCOM integration with Splunk dashboard shows "Could not create search"
search cancel

XCOM integration with Splunk dashboard shows "Could not create search"

book

Article ID: 226333

calendar_today

Updated On:

Products

XCOM Data Transport XCOM Data Transport - Windows XCOM Data Transport - Linux PC

Issue/Introduction

Followed steps to integrate XCOM for Windows with Splunk:
CA XCOM™ Data Transport® for Windows 11.6 Service Packs > Administrating > Splunk®Dashboard Samples

However, after executing some transfers the "Overall Summary" dashboard shows "Could not create search":

Environment

Release : 11.6

Component : CA XCOM Data Transport for Windows

Cause

After checking Splunk log file "C:\Program Files\Splunk\var\log\splunk\splunkd.log" the root cause was found:
10-14-2021 16:42:19.276 +1100 ERROR AlertsManager - Search not executed: The minimum free disk space (5000MB) reached for C:\Program Files\Splunk\var\run\splunk\dispatch. user=admin., concurrency_category="historical", concurrency_context="user_instance-wide", current_concurrency=0, concurrency_limit=5000

The server had less than 5GB of free space on C: drive

Resolution

Increased free space to > 5GB and the search results were returned (no need to restart Splunk Windows service):