Dashboards & Visualizations

Dashboard - Base search results differs from no same query results when query is fully specified

afsku
Engager

Hi,

I have two identical queries on the dashboard, the only difference - one is based on previously defined search results.  They produce very different charts however, here is the code and screenshots:

 

 

 

 

 

<form>
  <search id="events_search">
    <query>
      index = "*" | fields *
    </query>
    <earliest>$time_token.earliest$</earliest>
    <latest>$time_token.latest$</latest>
  </search>
  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="time_token">
      <label>Time</label>
      <default>
        <earliest>-48h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Errors (Based on events_search query)</title>
        <search base="events_search">
          <query>  search level IN ("error", "fatal") | timechart count 
          </query>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">all</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
    <panel>
      <chart>
        <title>Errors (Not based on any existing query)</title>
        <search>
          <query>  index = "*" | fields * | search level IN ("error", "fatal") | timechart count 
          </query>
        <earliest>-48h@h</earliest>
        <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">all</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
   </row>
</form>

 

 

 

Screen Shot 2021-03-22 at 1.45.31 PM.png

 

So I wonder if it is a bug or some sort of known behavior? 

Labels (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

This is known limitation of using none transforming base search. It return only xx k (500k if I recall right) results.

r. Ismo 

View solution in original post

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

This is known limitation of using none transforming base search. It return only xx k (500k if I recall right) results.

r. Ismo 

0 Karma

afsku
Engager

Thanks, @isoutamo , I should have read Optimizing Splunk Dashboards with Post-Process Searches , now I got my searches optimized and problem has gone.

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of Splunk APM’s and Splunk RUM’s streaming infrastructure in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...