Hi,
I have some issues with the experience score dashboard in Splunk.
The experience score dashboard in Splunk is telling us "no results found " for the applications category. The total score beneath "Today" seems to be always at 0
I have version 6.2 installed in Splunk as an app.
What could be wrong in my setup?
Hi Sven,
Please run the following search and describe your output. You should see data for the fields _time, AppId, host, and SourceIndex. The app_* fields may be empty.
The calculation of the app scores requires a working AppNameIdMapping. Please check if it is enabled in your configuration. In the default config, it's in timer two.
Today's score is always zero as it requires a working application score. As the latter is not there, the calculation fails.
Hi Dominik,
Which search do you mean exactly?
Pardon me. Below is the search:
| savedsearch trigger_populate_score_per_application
| savedsearch trigger_populate_score_per_application
Does not produce any results.
I looked into splunkhome\etc\apps\uberAgent\default\savedsearches.conf and I see this configuration:
[trigger_populate_score_per_application]
dispatch.earliest_time = -30m
dispatch.latest_time = now
search = | savedsearch populate_score_per_application [ | inputlookup lookup_score_application_configuration | xyseries setting setting value | stats values(*) as * | fields - setting]
run_on_startup = true
enableSched = 1
cron_schedule = */30 * * * *
schedule_window = auto
I tried the search that was in the configuration but it also did not provide any results.
Have you checked if AppNameIdMapping is configured?
Please run the following search and check if there are any results:
| savedsearch populate_appnameidmapping
Are you running Splunk Free? There are issues with AppNameIdMapping and Splunk Free.
I'm getting this output if I do that search:
Error in 'inputlookup' command: External command based lookup 'lookup_appnameidmapping' is not available because KV Store initialization has failed. Contact your system administrator.
Could not load lookup=LOOKUP-appnameidmapping
Could not load lookup=LOOKUP-hostinfo
We are using Splunk Enterprise. We are only using it for uberAgent.
Hi Sven,
The error message indicates that there are issues with the KV store. The AppNameIdMapping lookup is a KV store lookup.
KV store is implemented as Mongo DB. Please check your logs for any helpful errors or warnings.
index="_internal" log_level=ERROR OR log_level="WARN*" source="/opt/splunk/var/log/splunk/mongod.log"
Hi Dominik,
I found the issue thanks to the mongodb log file. We got an expired certificate for server SSL which I managed to replace. After replacing this certificate and a Splunk reboot. The application part of the Experience Score dashboard started working again.
Thank you for your assistance!
Hi Sven,
Good to hear that you solved the issue and thanks for the explanation!
Best regards
Dominik