topic Re: Key indicator question in Dashboards & Visualizations

Key indicator question

matt1t — Sun, 05 Jan 2020 03:43:58 GMT

I created a key indicator and when I click the preview button I get the results I want:

However, when I add this to my dashboard it will not show the results, any idea why?

Here is what my dashboard shows.

Re: Key indicator question

niketn — Sun, 05 Jan 2020 12:52:13 GMT

@matt1t once the search query runs, how are you moving the panel to your dashboard? Are you using Save as Dashboard option or are you merging the search <query> manually? By any chance are you using Post-Processing in the dashboard?

Re: Key indicator question

matt1t — Sun, 05 Jan 2020 14:44:37 GMT

On the dashboard I click edit, and then it has a plus sign which then loads a Add Indicators. I choose the indicator I created and then its added.

Re: Key indicator question

matt1t — Mon, 06 Jan 2020 15:46:30 GMT

I wonder is this is the issue. So when I click on the preview, my search runs and I get the data I expect. If I'm within the Content Management section and look at the info for my key indicator I get the following stats:

Statistics
Avg. Event Count ..... 17.36
Avg. Result Count ..... 0
Avg. Run Time ....... 0:00:02
Invocations ....... 25
Skipped ........ 0
Success ........0
Update Time ........ Jan 6, 2020 10:30:00 AM

So no successes and 25 invocations? What are invocations and how can I fix this?

Re: Key indicator question

matt1t — Mon, 06 Jan 2020 16:02:48 GMT

I figured it out, however this makes no sense. Many examples on the key indicators start with search and then the actual search. Example would be "search index=some_index earliest=-3d@d blah blah blah". With the search in front my preview works, but the results are missing on the dashboard. If I take the search out of it, the preview no longer work, however its now working on my dashboard. I don't know what made me try that but I now have my dashboard working so I'm happy. Maybe someone can explain the difference?

Thanks,

-Matt