topic Re: Why is the dashboard result different in production and acceptance environment? in Dashboards & Visualizations

Why is the dashboard result different in production and acceptance environment?

patmarton — Mon, 13 Aug 2018 09:02:01 GMT

Hello Splunkers,

I created a dashboard in splunk which is working fine based on our tests. When I moved it to production environment it shows false data. After going through the logs i found out that the exact same code shows duplicated values in the production environment.

I noticed that the code is fine, but after the following command, it shows duplicated values :

| stats list(RunTime) AS Run , avg(seconds) AS Average by SiteName, Country, SiteRegion

So the result before this line is:

**SiteName**  **RunTime**

Prague         10.9
Prague         10.2
Prague         19.8

And the result after that line is:

**SiteName**  **RunTime**

Prague         10.9
Prague         10.9
Prague         10.9
Prague         10.9
Prague         19.8
Prague         19.8
Prague         19.8
Prague         19.8

And so on.

I cannot really figure out why it happens, and also looking for a better solution than the dedup command.

Thank you.

Re: Why is the dashboard result different in production and acceptance environment?

kmaron — Mon, 13 Aug 2018 12:34:07 GMT

if you use values instead of list it will remove duplicates.

Re: Why is the dashboard result different in production and acceptance environment?

patmarton — Mon, 13 Aug 2018 14:41:29 GMT

Thank you for your answer. I do not really want to remove duplicates directly because there might be cases where the processing time is the same for different runs.

Re: Why is the dashboard result different in production and acceptance environment?

kmaron — Mon, 13 Aug 2018 14:42:31 GMT

Then what is it you're really aiming for?

Re: Why is the dashboard result different in production and acceptance environment?

patmarton — Wed, 15 Aug 2018 07:57:45 GMT

I need to know why data gets duplicated after that command. I can use dedup or values but in case there were two different runs with the same RunTime, I would lose one of them, and I only want to get rid of the duplicates.