Skip to main content

Data sources troubleshooting

In the case of data retrieval failures for any data source, except for Splunk Observability, you can check this data source's event logs:

  • The data source must be added with the direct connection method
  • Event logs must be activated in advance for your data source

⛭ Errors upon setting up an integration with Splunk Observability​

Clear the Nobl9 cache in your browser and set up the integration again.

⛭ No data from a data source​

Depending on the budgeting method, "no data" is treated as follows:

  • Occurrences: no good and no total events, so there is no effect on the ratio of good to total events.
  • Time slices: minutes with no data is considered good.

You can troubleshoot this situation in the following ways:

  • Verify your authentication credentials.
    To verify credentials on the Nobl9 Web, go to Integrations and click Edit on your required data source.
  • Verify the query.
    It’s a good practice to first apply the query you wrote in a test environment to make sure it returns valid metrics.
  • Make sure your query returns only one metric and one time series.
  • If you apply any filters in the query, it must point to the exact entity you want to observe.
    Nobl9 processes only one dataset—there is no aggregation on the Nobl9 side.

When all the above steps are verified but the SLO still doesn't show any data, review the data source integration log for any errors:

⛭ Empty or null metric values in Splunk queries​

Empty or null metric values can cause failures in parsing data from Splunk, resulting in gaps in the SLO charts.

The reason may lie in the n9value field requirements.

Nobl9 requires the n9value field to be a numeric type. If your Splunk query uses timechart and a specific time bucket contains no events, Splunk returns a NULL or empty string ("") for that bucket. This non-numeric value causes the ingestion to fail.

To replace empty or null values with zero and prevent such failures, use fillnull. For example,

Splunk query fragment addressing null or empty metric values
| timechart count as n9value
| fillnull value=0 n9value
Check out these related guides and references:
Event logsNobl9 featuresData anomaly detectionSLO oversightQuery checkerNobl9 featuresNobl9 agent troubleshootingTroubleshooting
On this page