topic Re: Why is the sort function not saving properly in dashboard panels? in Dashboards & Visualizations

Why is the sort function not saving properly in dashboard panels?

twmoffit — Mon, 10 Jul 2017 19:25:53 GMT

Hello,

I am having an issue where I want to sort my data in a chart but for some reason when I save and close the dashboard, my sort removed a " " (space) from the search. Here is an example,

I save the search as this and the largest 10 items return in my visualization:

....
| chart sum(FREE_GB) sum(USED_GB) over TS_NAME
| sort 10 -num("sum(USED_GB)")

However, when I save and then close or refresh the dashboard, ALL of the sorts on the dashboard change to this:

....
| chart sum(FREE_GB) sum(USED_GB) over TS_NAME
| sort 10-num("sum(USED_GB)")

Notice the space has been removed between "10 -num(..."

How do I stop this from happening? Is this just a bug in Splunk or is there something wrong with my syntax??
Thanks,

Re: Why is the sort function not saving properly in dashboard panels?

rjthibod — Mon, 10 Jul 2017 19:55:29 GMT

What version of Splunk are you running and what browser?

Re: Why is the sort function not saving properly in dashboard panels?

somesoni2 — Mon, 10 Jul 2017 19:57:33 GMT

Can you try like this?

....
 | chart sum(FREE_GB) as sum_FREE_GB sum(USED_GB) as sum_USED_GB by TS_NAME
 | sort 10 -num(sum_USED_GB)

OR just

....
 | chart sum(FREE_GB) as sum_FREE_GB sum(USED_GB) as sum_USED_GB by TS_NAME
 | sort 10 -sum_USED_GB

Re: Why is the sort function not saving properly in dashboard panels?

niketn — Tue, 11 Jul 2017 04:02:54 GMT

@twmoffit, we had noticed this issue with Internet Explorer (IE), however, the same worked fine with Chrome. Can you try that?

This seemed like a bug with IE.

Re: Why is the sort function not saving properly in dashboard panels?

jplumsdaine22 — Tue, 11 Jul 2017 09:00:26 GMT

This is a bug, fixed in 6.5.4 (see discussion here: https://answers.splunk.com/answers/547674/splunk-bug-fields-command.html)

See SPL-140551, SPL-140828, SPL-140807 in fixed issues here: http://docs.splunk.com/Documentation/Splunk/6.5.4/ReleaseNotes/6.5.4

After upgrading I recommend you run the following command so you can identify any affected dashboards and fix them on the filesystem.

find $SPLUNK_HOME/etc/users $SPLUNK_HOME/etc/apps -type f -name '*.xml' -exec grep -lr 'sort-\|fields-' {} +

Re: Why is the sort function not saving properly in dashboard panels?

twmoffit — Tue, 11 Jul 2017 13:52:26 GMT

Changing and saving the search in Chrome seemed to have fixed the problem for now. I hope this gets patched at some point soon though.

Re: Why is the sort function not saving properly in dashboard panels?

jplumsdaine22 — Tue, 11 Jul 2017 13:59:54 GMT

It has been patched (see below) However you will need to manually fix affected boards.

Re: Why is the sort function not saving properly in dashboard panels?

niketn — Tue, 11 Jul 2017 14:03:43 GMT

@twmoffit, did you check out, @jplumsdaine22 's answer that this bug has already been fixed in 6.5.4. If you are using 6.5.4 or later and still observe the issue you should report the same to Splunk Support through your Entitlement. Kindly upvote if this work-around has helped.

Also if you can upgrade to 6.5.4 or later then test and accept jplumsdaine22's answer.