Archive

Splunk 6.0 dashboards ignoring top

Communicator

Hi,

I have installed Splunk 6.0 for testing before upgrading my current production environment. Everything is rather new, but I am having trouble getting a simple dashboard to work, because the piping through top doesn't seem to work. It just displays the events as a list and not aggregated in a top 10. However if I run the inline search in Search it will display a properly formatted table.

I have read the Build dashboards in Splunk Web of the new 6.0 manual, but it doesn't seem to have anything special about it.

What am I missing? Can it be related to my data model definitions?

Tags (2)
1 Solution

Communicator

ineeman and melting, you are both correct.

Changing to a statistics table makes the result of top show again.

View solution in original post

0 Karma

Communicator

ineeman and melting, you are both correct.

Changing to a statistics table makes the result of top show again.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Could you provide the xml you are trying?

Possible you would like to use table tag in place of event tags - Event in 6.0 will always show the events vs results which come from reporting commands like top.

Or post screenshot.

Splunk Employee
Splunk Employee

Could you post the XML definition of your dashboard? I'm wondering if it is somehow set to an events panel, in which case it would show up the events that are behind your "top" query.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!