https://community.splunk.com/t5/Splunk-ITSI/Inaccurate-Data-over-Time-Glass-Table/m-p/502873#M2057 <P>Cool, thank you. I will look into these!</P> Mon, 21 Oct 2019 12:41:58 GMT logankinman99 2019-10-21T12:41:58Z https://community.splunk.com/t5/Splunk-ITSI/Inaccurate-Data-over-Time-Glass-Table/m-p/502869#M2053 <P>I have Glass Tables that use KPIs refreshing their searches every 15 minutes to show data in real time. The data is accurate at first, and refreshes the searches fine.<BR /> After a few hours, however, the data starts to slip and show incorrect results. If I do an ad hoc search in a different tab, it shows totally different results than what the glass table is showing. This happens with all of my Glass Tables, as well, not just one.<BR /> I don't know if I set up something wrong, or if this is an issue other people are having. Please let me know. Thanks!</P> <P>(Calculation: Calculating Average of __________ as aggregate over the last 15 minute(s) every 15 minute(s). Fill gaps in data with Null values and use a unknown threshold level for them.)</P> Thu, 17 Oct 2019 17:45:10 GMT https://community.splunk.com/t5/Splunk-ITSI/Inaccurate-Data-over-Time-Glass-Table/m-p/502869#M2053 logankinman99 2019-10-17T17:45:10Z https://community.splunk.com/t5/Splunk-ITSI/Inaccurate-Data-over-Time-Glass-Table/m-p/502870#M2054 <P>wild dart in the night, try to fill data gaps with last available value ... also try do it whenever you can ...</P> Thu, 17 Oct 2019 18:45:44 GMT https://community.splunk.com/t5/Splunk-ITSI/Inaccurate-Data-over-Time-Glass-Table/m-p/502870#M2054 adonio 2019-10-17T18:45:44Z https://community.splunk.com/t5/Splunk-ITSI/Inaccurate-Data-over-Time-Glass-Table/m-p/502871#M2055 <P>See that's what I was thinking too..It changed the results, but still didn't match the accurate searches</P> Fri, 18 Oct 2019 19:26:23 GMT https://community.splunk.com/t5/Splunk-ITSI/Inaccurate-Data-over-Time-Glass-Table/m-p/502871#M2055 logankinman99 2019-10-18T19:26:23Z https://community.splunk.com/t5/Splunk-ITSI/Inaccurate-Data-over-Time-Glass-Table/m-p/502872#M2056 <P>I would check the amount of skipped searches because it is possible that you are not getting them triggered on the schedule time and it can cause the gaps in your data.<BR /> Also check how long the reports does take to be completed using the job inspector<BR /> Run the report manually to check if you have the proper results, if so, it is potential you have issues with these skipped searches.<BR /> Are you working with summary index? If so, check if the reports are completed successfully or being triggered on the scheduled time.<BR /> Use the Management Console to check the report schedule<BR /> here is link to the document<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.3.2/DMC/Scheduleractivity">https://docs.splunk.com/Documentation/Splunk/7.3.2/DMC/Scheduleractivity</A><BR /> If you are not able to identify the issue, open a case at Splunk support and upload the Splunk diag files for analysis.</P> Mon, 21 Oct 2019 02:24:30 GMT https://community.splunk.com/t5/Splunk-ITSI/Inaccurate-Data-over-Time-Glass-Table/m-p/502872#M2056 ivanreis 2019-10-21T02:24:30Z https://community.splunk.com/t5/Splunk-ITSI/Inaccurate-Data-over-Time-Glass-Table/m-p/502873#M2057 <P>Cool, thank you. I will look into these!</P> Mon, 21 Oct 2019 12:41:58 GMT https://community.splunk.com/t5/Splunk-ITSI/Inaccurate-Data-over-Time-Glass-Table/m-p/502873#M2057 logankinman99 2019-10-21T12:41:58Z