Anyone know why I would see NaNd ago in a panel as the age of the data being displayed within a panel. Usually its showing how long ago the scheduled search ran.
My earlier answer was wrong, and indeed I was able to reproduce the problem in SVU 2.6.3.
I was able to diagnose it and fix it, and the fix will release in 2.6.4, sometime within the next week.
Workaround:
If you avoid using the group="foo"
attributes in the dashboard panels where the "NaNd ago" text is appearing, then this will make that whole "-2d ago" bit dissappear entirely, taking it's "NaNd ago" bug with it. Granted if you like that little "-2d ago" cue then this isn't a great solution.
As for the green header text itself, it's easy to replace this with an HTML module
<module name="HTML">
<param name="html"><![CDATA[
<h3>Foo Header</h3>
]]></param>
</module>
and if you must have it be green and look exactly like the other one, then you can just copy the exact markup that Splunk uses there.
<module name="HTML">
<param name="html"><![CDATA[
<div class="splHeader splHeader-dashboard">
<h2>Foo group</h2>
</div>
]]></param>
</module>
But again, the underlying will be fixed in 2.6.4, so if the date on your calendar is september 2013 or later, then just upgrade to the latest Sideview Utils and you'll be good.
My earlier answer was wrong, and indeed I was able to reproduce the problem in SVU 2.6.3.
I was able to diagnose it and fix it, and the fix will release in 2.6.4, sometime within the next week.
Workaround:
If you avoid using the group="foo"
attributes in the dashboard panels where the "NaNd ago" text is appearing, then this will make that whole "-2d ago" bit dissappear entirely, taking it's "NaNd ago" bug with it. Granted if you like that little "-2d ago" cue then this isn't a great solution.
As for the green header text itself, it's easy to replace this with an HTML module
<module name="HTML">
<param name="html"><![CDATA[
<h3>Foo Header</h3>
]]></param>
</module>
and if you must have it be green and look exactly like the other one, then you can just copy the exact markup that Splunk uses there.
<module name="HTML">
<param name="html"><![CDATA[
<div class="splHeader splHeader-dashboard">
<h2>Foo group</h2>
</div>
]]></param>
</module>
But again, the underlying will be fixed in 2.6.4, so if the date on your calendar is september 2013 or later, then just upgrade to the latest Sideview Utils and you'll be good.
Awesome, thanks!
I'm using SVU 2.4.8 and I'm seeing behavior. Interesting, it displays "NaNd ago" when I deploy the dashboard to the search head pool but displays properly when I have it on our dev search head - both have the same versions of everything.
I have other dashboards in this search head pool that, while using the same modules, are displaying the time ago just fine. All files are literally rsync'd and nothing is modified, so this business with the line breaks is a bit much for me to believe. Is there any other explanation for it?
Nice catch, I am also using pooled search heads
From what I found I get this when using the sideview utils SavedSearch Module. Looks like this is a prototype module.
It would help if you could provide more information about the specific panel, view, and search in question. If you inspect the search, do you see that it completed successfully?
Sounds like some kind of glitch to me. Maybe even a bug...
I'm assuming NaN is the usual not a number deal, but no big ideas yet. Do you have any more information?