XCOM integration with Splunk dashboard shows "Could not create search"
Article ID: 226333
Updated On:
Products
Issue/Introduction
Followed steps to integrate XCOM for Windows with Splunk:
CA XCOM™ Data Transport® for Windows 11.6 Service Packs > Administrating > Splunk®Dashboard Samples
However, after executing some transfers the "Overall Summary" dashboard shows "Could not create search":
Environment
Release : 11.6
Component : CA XCOM Data Transport for Windows
Cause
After checking Splunk log file "C:\Program Files\Splunk\var\log\splunk\splunkd.log" the root cause was found:
10-14-2021 16:42:19.276 +1100 ERROR AlertsManager - Search not executed: The minimum free disk space (5000MB) reached for C:\Program Files\Splunk\var\run\splunk\dispatch. user=admin., concurrency_category="historical", concurrency_context="user_instance-wide", current_concurrency=0, concurrency_limit=5000
The server had less than 5GB of free space on C: drive
Resolution
Increased free space to > 5GB and the search results were returned (no need to restart Splunk Windows service):
Feedback
