Troubleshoot
Find answers to the most common errors encountered when using Hydrolix Search for Splunk.
"Invalid Argument" messages when making queries⚓︎
This usually means the table name or field name doesn't exist. Verify the table and field names.
Splunk doesn't respect the default cluster's configuration⚓︎
If a non-default cluster is named default, upgrade to Hydrolix Search for Splunk v1.0.6 or later, or rename the non-default cluster.
Local Splunk UI limits results to 1,000⚓︎
When running Splunk locally, the UI limits results to 1,000 and subsequent pages are blank. To increase the limit, navigate to or create $SPLUNK_HOME/etc/system/local/limits.conf and add the following:
See Splunk's limits.conf documentation for more information.
Maximum time range exceeded error⚓︎
Hydrolix can enforce a maximum time range on queries, configured per cluster. If an alert or dashboard panel covers a window longer than the configured maximum, the query fails with this error. Check the configured limit with the Hydrolix administrator and keep query time windows at or below the maximum.
hdxsql or hdxdescribe command is unknown⚓︎
The hdxsql and hdxdescribe commands aren't available in older versions of Hydrolix Search for Splunk. An app version that predates these commands causes Splunk to report them as unknown search commands when the search runs.
Update the app to version 1.5.0 or later:
- Go to Apps > Manage Apps.
- Type Hydrolix in the search box, and under Version, click Update.