Dashboards & Visualizations

Data not matching btw panel and search app

Ram2
Explorer

When we use a below query, in dashboard panel data is not showing correctly, if  we open the panel query in "open in search data is showing correctly.

How to fix this issue??

index=dam-idx (host_ip=12.234.201.22 OR host_ip=10.457.891.34 OR host_ip=10.234.34.18 OR host_ip=10.123.363.23) repoter.dataloadingintiated
|stats count by local
|append
[search index=dam-idx (host_ip=12.234.201.22 OR host_ip=10.457.891.34 OR host_ip=10.234.34.18 OR host_ip=10.123.363.23) task.dataloadedfromfiles NOT "error" NOT "end_point" NOT "failed_data"
|stats count as FilesofDMA]
|append
[search index=dam-idx (host_ip=12.234.201.22 OR host_ip=10.457.891.34 OR host_ip=10.234.34.18 OR host_ip=10.123.363.23) "app.mefwebdata - jobintiated"
|eval host = case(match(host_ip, "12.234"), "HOP"+substr(host, 120,24), match(host_ip, "10.123"), "HOM"+substr(host, 120,24))
|eval host = host + " - " + host_ip
|stats count by host
|fields - count
|appendpipe
[stats count
|eval Error="Job didn't run today"
|where count==0
|table Error]]
|stats values(host) as "Host Data Details", values(Error) as Error, values(local) as "Files created localley on AMP", values(FilesofDMA) as "File sent to DMA"
Labels (1)
0 Karma

Ram2
Explorer

Panel displaying in dashboard:

Ram2_0-1714958133593.png

 



When we open the panel in search showing as below:(this is the correct data)

Host Data DetailsErrorFiles created localley on AMPFile sent to DMA
HOM-jjderf - 10.123.34.18
HOM-iytgh - 10.123.363.23
HOP-wghjy - 12.234.201.22
HOP-tyhgt - 12.234.891.34
 22186

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Your search is rather odd - firstly you are doing

...
| stats count by local

and at the end you are doing 

| stats ... values(local) as ...

which doesn't make a lot of sense, unless local is always 221 in your example.

Is this dashboard studio or classic and are you using any base searches here?

 

0 Karma

Ram2
Explorer

this is a classic dashboard and no base searches used.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Can you post your XML for the entire <panel>

inside a code formatting block <>

 

0 Karma

Ram2
Explorer

<form version="1.1" theme="dark"> <label>DMT Dashboard</label> <fieldset submitButton="false"> <input type="time" token="timepicker"> <label>TimeRange</label> <default> <earliest>-15m@m</earliest> <latest>now</latest> </default> </input></fieldset> <row> <panel> <table> <search> <query> index=dam-idx (host_ip=12.234.201.22 OR host_ip=10.457.891.34 OR host_ip=10.234.34.18 OR host_ip=10.123.363.23) repoter.dataloadingintiated |stats count by local |append [search index=dam-idx (host_ip=12.234.201.22 OR host_ip=10.457.891.34 OR host_ip=10.234.34.18 OR host_ip=10.123.363.23) task.dataloadedfromfiles NOT "error" NOT "end_point" NOT "failed_data" |stats count as FilesofDMA] |append [search index=dam-idx (host_ip=12.234.201.22 OR host_ip=10.457.891.34 OR host_ip=10.234.34.18 OR host_ip=10.123.363.23) "app.mefwebdata - jobintiated" |eval host = case(match(host_ip, "12.234"), "HOP"+substr(host, 120,24), match(host_ip, "10.123"), "HOM"+substr(host, 120,24)) |eval host = host + " - " + host_ip |stats count by host |fields - count |appendpipe [stats count |eval Error="Job didn't run today" |where count==0 |table Error]] |stats values(host) as "Host Data Details", values(Error) as Error, values(local) as "Files created localley on AMP", values(FilesofDMA) as "File sent to DMA" <query> <earliest>timepicker.earliest</earliest> <latest>timepicker.latest</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentageRow">false</option> <option name="rowNumbers">true</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <format type="color" field="host_ip> <colorPalette type="map">{"12.234.201.22":#53A051, "10.457.891.34":#53A051,"10.234.34.18":#53A051,"10.123.363.23":#53A051}</colorPalette> </format> <format type="color" field="local"> <colorPalette type="list">[#DC4E41,#53A051]</colorPalette> <scale type="threshold">8</scale> </format> <format type="color" field="FilesofDMA"> <colorPalette type="list">[#DC4E41,#53A051]</colorPalette> <scale type="threshold">8</scale> </format> <format type="color" field="Files created localley on AMP"> <colorPalette type="list">[#DC4E41,#53A051]</colorPalette> <scale type="threshold">8</scale> </format> <format type="color" field="File sent to DMA"> <colorPalette type="list">[#DC4E41,#53A051]</colorPalette> <scale type="threshold">8</scale> </format> <format type="color" field="Error"> <colorPalette type="map">{"Job didn't run today":#DC4E41}</colorPalette> </format> <format type="color" field="Host Data Details"> <colorPalette type="map">{"HOM-jjderf - 10.123.34.18":#53A051"HOM-iytgh - 10.123.363.23":#53A051, HOP-wghjy - 12.234.201.22":#53A051, "HOP-tyhgt - 12.234.891.34":#53A051}</colorPalette> </format> </table> </panel> </row> </form>

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Please edit your post and use the code block feature when posting code, otherwise it's unreadable

bowesmana_0-1714968912315.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

As I said in a duplicate post, you don't appear to be referencing the timepicker token correctly - try using $timepicker.earliest$ and $timepicker.latest$

0 Karma

Ram2
Explorer

What do you mean by timepicker token correctly - try using $timepicker.earliest$ and $timepicker.latest$
i am using the same, i am not sure what is the issue here:

<form version="1.1" theme="dark">
<label>DMT Dashboard</label>
<fieldset submitButton="false">
<input type="time" token="timepicker">
<label>TimeRange</label>
<default>
<earliest>-15m@m</earliest>
<latest>now</latest>
</default>
</input>
<row>
<panel>
<table>
<search>
<query>
index=dam-idx (host_ip=12.234.201.22 OR host_ip=10.457.891.34 OR host_ip=10.234.34.18 OR host_ip=10.123.363.23)  repoter.dataloadingintiated
|stats count by local
|append
[search index=dam-idx (host_ip=12.234.201.22 OR host_ip=10.457.891.34 OR host_ip=10.234.34.18 OR host_ip=10.123.363.23)  task.dataloadedfromfiles NOT "error" NOT "end_point" NOT "failed_data"
|stats count as FilesofDMA]
|append
[search index=dam-idx (host_ip=12.234.201.22 OR host_ip=10.457.891.34 OR host_ip=10.234.34.18 OR host_ip=10.123.363.23)   "app.mefwebdata - jobintiated"
|eval host = case(match(host_ip, "12.234"), "HOP"+substr(host, 120,24), match(host_ip, "10.123"), "HOM"+substr(host, 120,24))
|eval host = host + " - " + host_ip
|stats count by host
|fields - count
|appendpipe
[stats count
|eval Error="Job didn't run today"
|where count==0
|table Error]]
|stats values(host) as "Host Data Details", values(Error) as Error, values(local) as "Files created localley on AMP", values(FilesofDMA) as "File sent to DMA"
<query>
<earliest>timepicker.earliest</earliest>
<latest>timepicker.latest</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentageRow">false</option>
<option name="rowNumbers">true</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="host_ip>
<colorPalette type="map">{"12.234.201.22":#53A051, "10.457.891.34":#53A051,"10.234.34.18":#53A051,"10.123.363.23":#53A051}</colorPalette>
</format>
<format type="color" field="local">
<colorPalette type="list">[#DC4E41,#53A051]</colorPalette>
<scale type="threshold">8</scale>
</format>
<format type="color" field="FilesofDMA">
<colorPalette type="list">[#DC4E41,#53A051]</colorPalette>
<scale type="threshold">8</scale>
</format>
<format type="color" field="Files created localley on AMP">
<colorPalette type="list">[#DC4E41,#53A051]</colorPalette
<scale type="threshold">8</scale>
</format>
<format type="color" field="File sent to DMA">
<colorPalette type="list">[#DC4E41,#53A051]</colorPalette>
<scale type="threshold">8</scale>
</format>
<format type="color" field="Error">
<colorPalette type="map">{"Job didn't run today":#DC4E41}</colorPalette>
</format>
<format type="color" field="Host Data Details">
<colorPalette type="map">{"HOM-jjderf - 10.123.34.18":#53A051"HOM-iytgh - 10.123.363.23":#53A051, HOP-wghjy - 12.234.201.22":#53A051, "HOP-tyhgt - 12.234.891.34":#53A051}</colorPalette>
</format>
</table>
</panel>
</row>
</form>
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Your search is written in a very strange way for Splunk SPL - so it makes it hard to understand what your data looks like and what you are actually trying to get to.

Based on your posted search, this is a more efficient replacement - try this search and see if this comes up with the same output as your basic search

index=dam-idx (host_ip=12.234.201.22 OR host_ip=10.457.891.34 OR host_ip=10.234.34.18 OR host_ip=10.123.363.23) 

   (repoter.dataloadingintiated) OR
   (task.dataloadedfromfiles NOT "error" NOT "end_point" NOT "failed_data") OR
   ("app.mefwebdata - jobintiated")

| eval host=if(match(_raw, "(?i)app\.mefwebdata - jobintiated"), case(match(host_ip, "12.234"), "HOP"+substr(host, 120,24), match(host_ip, "10.123"), "HOM"+substr(host, 120,24)) + " - " + host_ip , null())
| eval FilesofDMA=if(match(_raw, "task\.dataloadedfromfiles"), 1, 0)
| stats values(host) as "Host Data Details" values(Error) as Error values(local) as "Files created localley on AMP" sum(FilesofDMA) as "File sent to DMA" 
| appendpipe 
    [ stats dc("Host Data Details") as count 
    | eval Error="Job didn't run today" 
    | where count==0 
    | table Error]

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
<earliest>timepicker.earliest</earliest>
<latest>timepicker.latest</latest>

This shows you are not using the tokens correctly

0 Karma

Ram2
Explorer

got it its a typo error we used token correctly($timepicker.earliest$ and $timepicker.latest$)  but data is not matching in dashboard panel and when i open in search

may i know what is the issue here.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Ah, I knew I'd see this asked before...

0 Karma

bowesmana
SplunkTrust
SplunkTrust

and is local=221 for all events?

0 Karma

Ram2
Explorer

Yes Local=221 for all events

0 Karma

bowesmana
SplunkTrust
SplunkTrust

What is not displaying correctly - what is different between the two tables?

 

0 Karma

Ram2
Explorer

There is no difference in the query, same query in dashboard panel and same used in search too

0 Karma

Ram2
Explorer

Panel displaying in dashboard:

Ram2_0-1714958174455.png

 



When we open the panel in search showing as below:(this is the correct data)

Host Data DetailsErrorFiles created localley on AMPFile sent to DMA
HOM-jjderf - 10.123.34.18
HOM-iytgh - 10.123.363.23
HOP-wghjy - 12.234.201.22
HOP-tyhgt - 12.234.891.34
 22186

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...