Docs › Reference

Troubleshooting and FAQ

Common questions, and what to do when something looks wrong.

Answers to the questions people ask most, and what to do when something looks wrong.

My search finds nothing

Ask tries hard not to come back empty. When nothing has all your words, it looks for things with any of them and says Nothing has all of those words, so these have some of them. When nothing matches the words at all, it tries the closest spelling and says Nothing matched those words, so this is the closest spelling. Treat these results as suggestions, not answers.

If you still see Nothing matches …, try these in order:

1. Use fewer words. Keep the one that names the thing.
2. Check the sentence above the results. If Ask read a word as a type, a mark or a domain you did not mean, click its ✕, or click just the words instead.
3. If the question had conditions, look at the options Ask offers under it. Each one takes a condition off, or asks the same thing of a different kind, and shows how many it would find.
4. Try one of the example questions Ask offers under the message.

A common case: tables with PII finds no table marked Contains PII, because the mark is recorded on columns. Ask says so and lists the tables that hold a marked column. See What Ask understands.

A wildcard found nothing, or was refused

Two characters mean something of their own in the Ask box: * is every asset, and % matches a shape of name or key — cust%, %mer, %cust%. See What Ask understands.

• A pattern was refused. A pattern needs at least 3 characters beside the % means the pattern is too short to use the name and key indexes, so answering it would mean reading every asset in the repository. Add a letter or two.
• A pattern found less than you expected. A pattern is matched against an asset's name and its external key only — never its definition or the words around it. %cust% and customer are different questions, and the second is usually the one you want.
• %_id did not behave like SQL. The underscore is an ordinary character here, not a one-character wildcard, because so many harvested names contain one. %_id finds names and keys ending in _id, and nothing else.
• A * list is not narrowed. That is what it is for: add a kind (* tables), a domain (* in Banking) or a condition underneath.

A column of links is empty on one of the two things it links

Fixed. A link from a kind of thing to its own kind whose two directions read the same word — related to — is one question, so it is offered one way round only. The column and the condition used to read it the way the link happened to be recorded, so of two related business terms, one showed the other and the other showed an empty cell, while both of their pages showed the link.

Both ends now answer. Nothing needs re-recording, and a relation whose two directions read different words — broader than and narrower than — is unaffected: that is two questions and each is still read its own way round.

I pasted a column's name and got a different column

Fixed. Until this release, a name typed in full was matched a piece at a time with each piece left open-ended — so TEN_COL_2_64_82_47 could also match TENANT_COLLECTION_25_6400_8200_4799, because every piece of the second name begins with a piece of the first. It is now matched as the name you typed, with only the very end left open so that searching while you type still works.

If you had learned to work around this — quoting names, or searching for part of a name instead — you no longer need to. Pasting the whole name is now the most precise thing you can do, and on a large repository it is also much the fastest.

Why is a table listed last, or labelled demo data?

A result labelled demo data is an invented example, not something harvested from a real system. KRISID always lists these after every real result, whatever their score, and never shows one as a Best match. Do not act on them. Ask your administrator if you are not sure why they are in your repository.

Otherwise, results are ordered by how well they match your words. How much an asset is used can move it up, but it cannot put a busy table that merely mentions a word above the thing named by that word.

Ask stays on my old search

This is on purpose. Ask in the sidebar brings back the search you were last doing, so opening a result and coming back does not lose your list. To start again, do any of these:

• press New search beside the box;
• press Esc in the box;
• click Ask in the sidebar while you are already on the Ask page.

Each one empties the box and brings back the front of the Ask page.

I cannot edit anything

What you can change depends on your roles. The Viewer role can read the whole repository but cannot edit it. If you cannot edit an asset, its page says why at the top:

• A notice starting Read-only for and your name means you need a role that allows editing on this asset. A role held over the data domain it belongs to would cover it. Ask the asset's owner or your administrator.
• A notice starting Harvested. means the name and key come from the source system, so nobody can change them in KRISID. You can still change the attributes, responsibilities and links if your role allows.

If a banner at the top says you are looking at the repository as somebody else, nothing can be changed until you press Back to myself. See People, roles and access and Editing an asset.

Sign-up says it is closed

Sign-up is not open here means your administrator has not switched self sign-up on. It needs two things: a mail server, because every new account confirms its email address, and a list of email domains that may sign up. If you are told Addresses at … cannot sign up here, your email domain is not on that list. Either way, ask whoever runs the repository to invite you. See Signing in and creating an account.

I signed up and cannot sign in

If you created your own account and have not yet opened the email, you do not have an account yet — KRISID keeps a sign-up waiting until its link is followed, so that nobody can take an address they cannot read mail at.

Give it the password you chose and the screen tells you exactly that:

Your account is not finished yet: the email we sent to you@example.com has a link in it, and following that link is what makes the account. Look in that inbox — the spam folder too — and open it.

If the sign-up is more than 24 hours old, its link has expired and the message says to sign up again instead. Doing so sends a new link and stops the old one.

If instead you get That username and password do not go together, the password is not the one that sign-up was made with. Sign up again with the same address: the newer link replaces the older one.

Administrators can see who is waiting: Administration → People and Persona → Sign-up, under Recent sign-ups.

An asset says Missing in Source

Missing in Source means the last harvest that looked for this asset did not find it in the source system. The page says when it was first missed. Nothing has been deleted: the asset keeps its history, links and responsibilities, and goes back to In Source as soon as the source shows it again. Whoever owns the source decides whether it should come back or go. Do not delete it in a hurry.

Before you conclude anything went, check the source's Runs tab. A harvest that was refused part-way, or that ran with a narrower scope than usual, marks things absent that are still perfectly well there — and the run says so. A source whose whole estate suddenly reads Missing in Source is almost always a lost grant or a changed scope, not a lost warehouse.

When you have looked and are sure, they can be cleared in bulk rather than one at a time: see Clearing up what has gone. Nothing can be cleared until it has been missing for longer than the cut-off — thirty days unless somebody changes it — for exactly the reason above.

A session that nobody signed in for

If bash run.sh doctor says that live sessions belong to a script rather than a browser, it has found sessions left behind by an older run of the test suite.

The suite signs in through the real login endpoint, which records whatever the client called itself — and until this was fixed the client called itself Python-urllib, which its own tidying-up did not recognise. So every successful run left one live, unexpired session behind, and the next run slid its expiry rather than letting it lapse. They belonged to the sysadmin account, which makes them worth closing rather than ignoring.

New runs name themselves and take their own sessions away, so anything doctor reports is historical. Two runs can no longer overlap either — the suite takes a lock on the database and a second run refuses, naming the first — so a session cannot have its expiry slid by a run that started while another was finishing. Close what is left with:

bash run.sh revoke-script-sessions

It revokes rather than deletes, so the record that something was signed in stays readable while the door is shut. Nobody real is signed out: a person signs in again from the login page.

The numbers on a domain card

The number on a domain card, on Ask or on By Data Domain, counts everything the domain answers for. That includes what it owns directly and everything inside those things: a table's columns count as well as the table. That is why the number is often much bigger than the list of things the domain was given.

Two more things explain surprises:

• An asset owned by two domains is counted in both.
• An asset with its own owner is not counted under a domain it would otherwise inherit from.

Press a count on By Data Domain to open exactly those assets. The card and the list use the same rule, so they always agree. See Browsing by domain and by type.

A source says Sign-in was refused

The source system turned the credentials down. KRISID passes on what the system said, so read the rest of the message: it usually names the one thing to change. For Power BI, Fabric and Databricks on Azure, Microsoft's sign-in answers with a code starting AADSTS, and the common ones are:

Put the corrected details in with Change sign-in details on the source's page, then press Test connection. See Connections and harvesting.

If sign-in works but a later step is refused, the message ends with the source system's own reason, for example Power BI said: …. For Power BI, Workspaces on the source page takes workspace names or IDs; a name that matches no workspace is said by name.

If sign-in works but the harvest then reads nothing, the problem is permissions in the source system, not the secret. Open What to ask the administrator for on the source's page.

A harvest stopped and said it could read none of something

A run that says something like Not one of the 12 lakehouses in scope would say which schema its tables sit under has stopped on purpose. One item in a source refusing is ordinary and costs only that item; every item refusing usually means one permission is missing across the whole source, and a harvest that carried on would have written a clean-looking run with a whole tick's worth of content silently absent.

The message says how many refused and quotes the source system's own reason at the end. That reason is what to act on — it is nearly always one grant:

Fix the grant and run it again. Nothing was written wrongly in the meantime — that is the point of stopping.

Tableau content is missing from a project

Two things do this, and both now say so rather than leave you to find it.

Two projects with the same name. Tableau only requires a project name to be unique among its siblings, so Finance → Reports and Marketing → Reports are both called Reports. Workbooks are unaffected — Tableau gives each one its project's ID. Published data sources are given only the project's name, so in a duplicated name there is nothing to tell the two apart, and KRISID leaves them out rather than filing them in a project they are not in. Test connection on the source warns about this and names the projects: rename one of the pair in Tableau, or narrow the Projects box on the source so only one of them is in scope.

A project you cannot see. Content is placed by its project, so a project this identity has no access to takes its workbooks and data sources with it. Give the identity Viewer on the project, or a Site Administrator role.

I was signed out

The screen says Your session has ended. Sign in again to carry on. Reload the page to get the sign-in screen. Your session ends when:

• you have not used KRISID for a long time, around twelve hours;
• you signed out, or changed your password in another browser;
• your password was set again from an invitation link.

Nothing you saved is lost. Your saved searches and your Recently viewed list are kept on the server, so they are there when you sign in again, on any computer.

I cannot see Delete on an asset

Delete… appears beside the asset's key only for someone who may delete that asset. That needs Delete assets (ASSET_DELETE) held over it. In the starter model only Sysadmin has it; other roles need it ticked on the Permissions tab. A harvested asset also needs Delete harvested assets (HARVESTED_DELETE), which only Sysadmin has in the starter model. See Editing an asset.

A workflow email was not sent

Open the request and look under What the workflow did. The line for the email says why:

• No mail server has been set or Sending is switched off: set it up on Administration → Email, then press Try again.
• No email address for …: give that person an address under People, then press Try again. The retry uses their addresses as they are now.
• A mail server's own words: the server refused it. The email is tried again by itself a few times, and Try again sends it now.

A screen says something in this build went wrong

The message names a kind of fault and a reference, like "Something in this build went wrong handling that request (KeyError), so nothing was written. Reference 3ce9a093." That is a bug in KRISID, not something you did and not something your data caused.

Nothing was written. Every write sits inside one transaction, and a request that ends this way rolls back whole — so there is no half-finished change to find or undo.

Two places have the detail, and both are worth sending to us:

• Administration → Logs → System has a line under that reference, naming the request and what went wrong.
• The application's own log file — /var/log/krisid/krisid.log, or logs/krisid.log beside the application — has the full trace under the same reference. bash run.sh logs shows the end of it.

Send the reference and those two, and we can usually name the cause without asking you anything else. If the same reference keeps appearing on the same screen, say which screen and what you were doing.

Somebody else was changing the same things at the same moment

The message is "Somebody else was changing the same things at the same moment, so nothing was written. Try that again." Press the button again; it almost always goes through the second time.

Two saves that reach into the same corner of the repository at the same instant can each end up waiting for the other, and the database ends one of them so that neither waits forever. The one it ends is the one you see this message on, and nothing it was going to write was written — not part of it, not most of it. There is nothing to undo and nothing to check.

It should be rare. If you see it several times in a day, the activity log's System tab records each one with what was being changed, and that is worth sending on: the usual cause is two bulk operations — a link of hundreds of assets, a harvest and an approval — habitually landing together.

A separate message, "That took longer than this is allowed to wait, so nothing was written. Try a smaller change, or again in a moment.", is the other side of the same coin: a save that sat waiting for a lock rather than being ended by one. Nothing was written then either. If it was a bulk change, do it in two halves.

An edit on an asset writes directly, though a workflow exists

A workflow may be for only some assets of its type. Open the workflow and look at Only for these under Starts on. If the asset is left out and no other workflow takes it in, changes to it are written directly. See Requests and approvals.

Changes through the API or a workbook load follow the Workflow controls on People and Persona, which write directly by default. Someone holding Load past workflows always loads directly.

A new asset is not in search yet

Search and Ask read a layer built from your assets rather than the assets themselves, and it is built in the background so that cataloguing thousands of things does not make the rest of the product slow.

A handful of changes are picked up within seconds. A big harvest or load is worked through at about a hundred assets a second once there is a backlog — a quarter of an hour for a hundred thousand, under two hours for six hundred thousand.

Until a thing's turn comes it does not appear at all, rather than appearing wrongly, and counts are worked out from the same layer so a total can be low for the same few minutes. Something renamed keeps answering to its old name until its turn comes.

If it is still missing long after the load finished, that is not this, and it is worth telling whoever runs the repository. They can ask the installation how much of the layer is built, and rebuild it deliberately:

bash run.sh rebuild-context

It is resumable, says how far it has got, and takes under an hour on a very large repository. It is also the right tool — rather than waiting — after any load that went into the database directly instead of through KRISID, because the background catch-up for those is a safety net rather than a catch-up and will not get through a large one in any useful time.

A screen is slow just after somebody saved something

The dashboard, the metamodel, the semantic layer, the estate tree and the Ask page are summaries of the whole repository, so they are worked out once and kept until something changes. Any save changes something, so the first person to open one of those screens after a save waits for it to be worked out again — a second or two on a large repository — and everybody after them gets it immediately.

If several of you open the same screen at the same moment, only one of you pays for it; the rest wait for that one and then all of you get the answer together.

Nothing here is ever served stale. The one exception is the example questions on the Ask page, which are suggestions and are refreshed on a timer rather than on every save, so they can be up to two minutes behind a change to the model. An administrator who writes those examples sees their own change at once.

The graph says it is full

The graph and the Connections view read as far out as a diagram can show and then stop, rather than returning everything connected. On a harvested estate almost every column is connected to almost everything else through its table, its schema and its database, so "everything connected" can be the entire repository — which no browser can draw and nobody can read.

Nothing is hidden from you. The screen says the nearest N assets — more are connected, and the hop picker offers As far as it fits rather than All. Open the graph from the thing you actually mean — a table or a schema rather than one of its columns — and the picture is the part you were asking about.

Raising Hops will not help here. Full means the picture filled up before the hop limit was reached; More beyond is the other case, and that one the hop picker does undo.

Everybody sees a maintenance page

Somebody has switched it on, or a maintenance window is open. Whoever holds Manage users and roles can sign in as normal: open People and Persona → Maintenance and untick Show the maintenance page, or clear the window. Everybody else is signed out while it is on, so they will have to sign in again afterwards.

The Username and Email columns have gone

They need See usernames and email addresses (PERSON_IDENTIFY), which arrived in v83. A line under the tabs on People and Persona says so when they are not shown. The addresses are still there — you are not being shown them.

Whoever administers access was given the permission when the repository was upgraded, so if you held Manage users and roles and the columns are missing, something has since been unticked: look at the Permissions tab, or the History tab, which names who changed it and when.

Your own username and address are on your profile, in the corner at the top right, whether you hold the permission or not.

Download the current access model says it needs a permission

Same permission, and it refuses rather than giving you a copy with the usernames taken out. The workbook is keyed on usernames — the Users, Team members and Assignments sheets all match on them — so a copy without them would upload as "create everybody again, and drop every assignment held by a person". There is no safe partial version, so there is no partial version.

If you only need to apply a workbook somebody else sent you, that is a different permission (Manage users and roles) and still works: drag the file into step 3.

I cannot find an older run on a source

The Runs table shows the last 90 days — or whatever logs are set to be kept for, which is the same decision — 100 to a page. Three things to try, in order:

1. Page back. The pager under the table says Showing 1–100 of 412; Rows changes the page size.
2. Press Show every run. Harvest runs are never pruned, so everything the source has ever done is still there whatever the window says.
3. Open the run you want and look at its passes. A sync of a source read one database at a time is one row with the passes folded under it — press the number beside it. Each pass names its database.

Until this release the table showed the last twenty rows with no pager at all, and one night's sync of a twelve-database account filled it. If you learned to read this screen by looking at the activity log instead, you no longer have to.

A source says it needs a driver

Snowflake and Databricks each need a library KRISID does not ship — about 90 MB, for a source most installations never have. The message names the exact command and which Python, which matters: pip install on its own installs into whichever Python is first on the PATH, and if that is not the one the application is running, the message does not change and nothing says why.

Everything else about that connection works without it — its settings, its grants script, what it would bring. Only connecting refuses.

For whoever runs the repository: bash run.sh doctor names any missing driver, and says whether a source configured here needs it. bash run.sh drivers installs the ones that are needed. A release does that for you, so after the next push this normally fixes itself. The application has to be restarted after an install, which a release does anyway.

A sync or preview says the source is too big to work out

The message names how many things the source presented, roughly how much memory working that out needs, and how much this machine has. Nothing was changed — a harvest phase writes everything or nothing, so there is no half of it to keep, and no clearing up to do.

Narrow what the source brings: open the source, Narrowing, and name one database rather than all of them. Sync it, then the next. Each run tells you what that database cost, which is how you find out the shape of your own estate. The message also says roughly how many things would fit, so you can judge it rather than guess.

It applies to Preview too, and that is deliberate: working out what a harvest would do is the expensive half, not writing it. A preview of a scope too large to plan is refused rather than attempted, because the alternative is the application being stopped by the operating system part way through — which is what used to happen, after an hour of waiting, with nothing to show for it.

If a repository genuinely needs the whole estate in one run, the box needs more memory: roughly 4 KB per thing read — so about 600,000 things on 4 GB, 1.4 million on 8 GB. Whoever runs the installation can read the measurements in SIZING.md.

Related

• What Ask understands
• Signing in and creating an account
• Glossary
• Ask: search and questions