topic Re: splunk dashboard studio result variance in Splunk Enterprise

splunk dashboard studio result variance

selvam_sekar — Tue, 30 Apr 2024 01:28:11 GMT

Hi,

I am calculating the difference between two search results as below. And, sometime the panel takes bit time to return the results, thus the variance is showing false count.

Please could you suggest ? how to fix

Thanks in advance.

SPL:

| makeresults | eval variance=$MA:result.macoscount$ - $COSMOS:result.cosmacount$ | table variance

Issue:

middle panel (with blue color) result is "MA to COSMOS value "- COSMOS to P.H.B"

Re: splunk dashboard studio result variance

Richfez — Mon, 29 Apr 2024 18:22:01 GMT

I get the feeling you've somehow overflowed one or both of your counts?

Why not split it out temporarily into three pieces - one being "$MA:result.macoscount$", another being "$COSMOS:result.cosmacount$" then finally the subtraction. If nothing else it'll help narrow down what's going on!

Re: splunk dashboard studio result variance

bowesmana — Tue, 30 Apr 2024 00:25:30 GMT

Are the time ranges for both searches the same - if the search is to "now" as latest time, then naturally they could come up with different results depending on when the search is dispatched and how long it takes to run.

I am guessing these are some kind of requests, so MA->COSMOS->PHB - is a negative figure not possible? Presumably there can be requests from COSMOS->PHB at the start of the search window that do not have corresponding requests inside the range from MA->COSMOS - without knowing your environment it's impossible to know.