Missing Data in the Dashboard Tile

jaibalaraman — Fri, 30 Aug 2024 08:46:14 GMT

Hi All

We have created a dashboard to monitor CCTV and it was working fine. However suddenly data stopped populating. We have done any change.

My finding

1 - If i select last 30 days i can see the dashboard working fine

2 - If i select time range last 20 days i can the dashboard is not working

3 - Started trouble shooting the issue and found the below

Spl query

The below works fine when the time range is last 30 days

working - index=test 1sourcetype="stream" NOT upsModel=*1234*
|rename Device AS "UPS "
|rename Model AS "UPS Model"
|rename MinRemaining AS "Runtime Remaining"
|replace 3 WITH Utility, 4 WITH Bypass IN "Input Source"
|sort "Runtime Remaining"
|dedup "UPS Name"
|table "UPS Name" "UPS Model" "Runtime Remaining" "Source" "Location"

Note- The same spl query dont work when time range is last 20 days.

Trouble shooting - Splunk receiving data till date however i have notice few thing,

When i select last 30 days i can see the by fields in the search

UPS Name , UPS Model , Runtime Remaining , Source

When i select last 20 days the below fields are missing not sure why?

Missing fields - UPS Name , UPS Model , Runtime Remaining , Source . So the below SPL query is not showing any data

The highlighted part not pulling any data due to missing field.

Thanks

Re: Missing Data in the Dashboard Tile

ITWhisperer — Fri, 30 Aug 2024 09:18:48 GMT

Check your index to see when data was last entered

| metadata type=sourcetypes index=test | fieldformat recentTime=strftime(recentTime,"%F %T") | fieldformat firstTime=strftime(firstTime,"%F %T") | fieldformat lastTime=strftime(lastTime,"%F %T")

Re: Missing Data in the Dashboard Tile

jaibalaraman — Fri, 30 Aug 2024 09:32:31 GMT

Re: Missing Data in the Dashboard Tile

ITWhisperer — Fri, 30 Aug 2024 09:36:23 GMT

What do you get if you set the timeframe for that search to be last 30 days?

Re: Missing Data in the Dashboard Tile

jaibalaraman — Fri, 30 Aug 2024 09:42:37 GMT

Re: Missing Data in the Dashboard Tile

ITWhisperer — Fri, 30 Aug 2024 10:19:05 GMT

Try this over last 30 days

index=* | timechart span=1d count by sourcetype

topic Missing Data in the Dashboard Tile in Splunk Search

Missing Data in the Dashboard Tile

Re: Missing Data in the Dashboard Tile

Re: Missing Data in the Dashboard Tile

Re: Missing Data in the Dashboard Tile

Re: Missing Data in the Dashboard Tile

Re: Missing Data in the Dashboard Tile