topic Re: Single Value - Displays differently when on Search and on Dashboard in Splunk Search

Single Value - Displays differently when on Search and on Dashboard

arielpconsolaci — Thu, 03 Aug 2017 08:40:16 GMT

Hi fellow Splunkers.

I have a scenario where my query that I want to show as a Single Value displays differently when done in Search and when placed in the dashboard.
Anyone who can advise how do I troubleshoot this? Thank you,

When i run my query in Search, my single value displays as (over 500,000):

However in my saved panel that I placed in my dashboard, the panel shows a different value, and furthermore defaults to 500,000

Re: Single Value - Displays differently when on Search and on Dashboard

inventsekar — Thu, 03 Aug 2017 09:01:06 GMT

you mean, the difference in the values you want to troubleshoot? or that yellow warning symbol you want to troubleshoot?
what message you get from that yellow symbol?

Re: Single Value - Displays differently when on Search and on Dashboard

arielpconsolaci — Thu, 03 Aug 2017 09:07:10 GMT

Thanks for responding @inventsekar.

What i mean is. when i run my query in Search, I am getting a single value of over 800,000.
But in my saved panel that i placed in my dashboard, value does not display over 800,000 but defaults to 500,000 instead.

Please don't mind the yellow warning symbol.

Re: Single Value - Displays differently when on Search and on Dashboard

niketn — Thu, 03 Aug 2017 10:13:45 GMT

@arielpconsolacion, can you make sure the following are same in Search vs Dashboard?
1) Time Range for search
2) span for timechart command like timechart span=1h ...
3) If the Compared to or Trend Interval option is not Auto, it is the same in Search and dashboard.

If all above are same then run the search in Fast Mode and not Verbose to see if there is a difference in count. Share the Search query in that case for us to assist further.

Re: Single Value - Displays differently when on Search and on Dashboard

niketn — Thu, 03 Aug 2017 10:21:18 GMT

@inventsekar, if you are seeking further details or are unsure of the answer provided it is better to add a comment rather than Answer, so that the question remains visible to other Splunkers for answering. Refer to Splunk Answers guideline on the same: http://docs.splunk.com/Documentation/Splunkbase/splunkbase/Answers/Questions#How_to_answer_a_question