topic Re: Real Time Dashboard issues in Dashboards & Visualizations

Real Time Dashboard issues

FraserC1 — Fri, 23 Feb 2018 10:15:39 GMT

Hi,

I've built a real time dashboard but I am seeing some strange issues.
So on the dashboard page itself, it displays perfectly without any issues.
But when I make it my home dashboard, the time inverts and starts showing the oldest events at the top.

I have no idea why this is happening.

Below are some screenshots of the search and the time settings.

Re: Real Time Dashboard issues

FraserC1 — Fri, 23 Feb 2018 10:17:28 GMT

I cannot post anymore photos, so here is the search:

severity_name=alert OR severity_level=alert OR severity_name=critical OR severity_level=critical OR severity_name=emergency OR severity_level=emergency OR severity_name=error OR severity_level=error OR severity_name=informational OR severity_level=informational OR severity_name=notification OR severity_level=notification OR severity_name=warning OR severity_level=warning |fields eventtype

The time is set to: rt-23h & rtnow

Re: Real Time Dashboard issues

mayurr98 — Fri, 23 Feb 2018 11:23:32 GMT

can you try sort- 0 Time at the end of the search?

Re: Real Time Dashboard issues

FraserC1 — Fri, 23 Feb 2018 11:26:29 GMT

Hi There,

Sorry I should have said I was added sort - _time at the end of the search and it didn't make a difference.

Interestingly, it seems to have sorted itself out. I'm nt sure if there is some sort of delay or something like that. I've found the custom dashboards to be fairly difficult to set up.

Re: Real Time Dashboard issues

mayurr98 — Fri, 23 Feb 2018 11:29:54 GMT

can you provide entire query?

Re: Real Time Dashboard issues

FraserC1 — Fri, 23 Feb 2018 11:40:27 GMT

Sorry what do you mean the entire query?
The only thing I'm searching is with severity_name=alert OR severity_level=alert OR severity_name=critical OR severity_level=critical OR severity_name=emergency OR severity_level=emergency OR severity_name=error OR severity_level=error OR severity_name=informational OR severity_level=informational OR severity_name=notification OR severity_level=notification OR severity_name=warning OR severity_level=warning |fields eventtype

Re: Real Time Dashboard issues

mayurr98 — Fri, 23 Feb 2018 12:23:24 GMT

try in ascending order sort _time
also can you try | rtorder discard=t ?
Also try | sort -_indextime

let me know if any of the above works!

Re: Real Time Dashboard issues

FraserC1 — Fri, 23 Feb 2018 14:49:36 GMT

Hi there, I tried | rtorder discard=t and it sorted it!
Are you able to explain what this statement does? Or maybe there is documentation on it?

Thanks for the help!

Re: Real Time Dashboard issues

mayurr98 — Fri, 23 Feb 2018 14:53:04 GMT

Yes there is a good documentation on rtorder command
https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Rtorder

Accept the answer if it solves your problem!