topic Display latest data in Dashboards & Visualizations

Display latest data

thaara — Tue, 28 Jul 2020 11:28:43 GMT

Hi Splunkers,

We have two slices in a pie chart. This is for deployment. One is for Successful log and another is for failure log. We are checking for the count for successful and failure logs. Consider, we have 10 successful log and 2 failure logs. Those two failure logs details have been analysed and deployments have happened and it got reflected in successful log as well, so that the overall count is 12 successful logs and 2 failure logs. Even though we have deployed the failed labels and those are reflecting fine in successful log slice, the same failure log is coming in failure log as well which is making mismatch in the original count. Is there any way to have the latest data alone in the pie chart.

Please note, we have pie chart and we are having two slices -> deployment success and deployment failure

Re: Display latest data

richgalloway — Tue, 28 Jul 2020 12:41:52 GMT

Please share the search you are using to create the pie chart.

Re: Display latest data

thaara — Tue, 28 Jul 2020 13:32:40 GMT

@richgalloway Please find the query below.

index=XXX sourcetype=YYY source=*deploy_status.list host=ABC OR host=DEF
| stats count by Deploy_Status

FYI, we have given field extractions for the comma delimiters

Output for this log is as below

ABC,project/env,7654321,jenkins-111111.mnopqrs.int-554@abc,Deployment_Failed
ABC,project/env,7654321,jenkins-121211.qwertyui.int-560,Deployment_Successful

Re: Display latest data

richgalloway — Tue, 28 Jul 2020 13:48:01 GMT

It's possible to consider only the latest events, but there needs to be a field that distinguishes one set of failed/success events from another. I'm assuming that's the field with the value 7654321 in the sample logs.

index=XXX sourcetype=YYY source=*deploy_status.list host=ABC OR host=DEF | rex "([^,]+?,){2}(?<id>\d+)" | dedup id | stats count by Deploy_Status

The dedup command takes the most recent event with an unseen value in the given field. If the id field is already extracted (perhaps by another name) then you can remove the rex command and update dedup.

Re: Display latest data

isoutamo — Tue, 28 Jul 2020 13:52:19 GMT

one way is to use dedup with sortby option to get the latest/newest event only.
r. Ismo