Dashboards & Visualizations

Default dashboard search mode change in 8.2?


Hello everyone. 

I have a dashboard with embedded queries that has stopped working since my update from 8.1 to 8.2.1.

The query is as follows:

host=sftpserver* source=/var/log/messages close bytes read written | rex "close \"(?<filename>.[^\"]+)" |rex "written (?<writebytes>\w+)" | rex "read (?<readbytes>\w+)" | eval rfile=if(readbytes == 0, null(), filename) | eval wfile=if(writebytes == 0, null(), filename) |eval writemb=(writebytes/1024/1024) | eval readmb=(readbytes/1024/1024) | eval readmb=round(readmb,2) | eval writemb=round(writemb,2) |eval datetimestr=strftime(_time, "%Y-%m-%d %H:%M")| chart count(rfile)

The query just gives a count of the number of files download from my SFTP server.

Since the update, the dashboard that includes this query (and several others) now only shows data from before the time when Splunk was updated.

Copying the query from the dashboard into a search, I can get the query to work in verbose mode but neither Fast nor Smart mode will return any results.

Labels (1)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!