Dashboards & Visualizations

Deployment Monitor Forwarder Warnings

glancaster
Path Finder

So I check Deployment monitor daily to get a quick overview of my environment. What I'm seeing after I upgraded, is the 'dm missing forwarders' search that runs the Forwarder Warnings dashboard panel is reporting "3d ago" which is when I upgraded the app.

I checked the saved search 'dm missing forwarders' and verified the time range is set to Start time = -24h and Finish Time = now

Running it manually works fine but the dashboard panel reports "3d ago". Has anyone seen anything like this? Is there a way to purge the dashboard panels saved results?

0 Karma

ShaneNewman
Motivator

The saved searches that power the dashboards should update on a regular basis. If you want to refresh them more often, go into the savedsearches.conf of that app and update the frequency of when the searches run to update the dashboards.

0 Karma

ShaneNewman
Motivator

The module should look something like this:

    <module name="HiddenSavedSearch" layoutPanel="panel_row5_col1">
      <param name="savedSearch">_capsule_details_search</param>
      <param name="useHistory">True</param>

You will just need your savedsearch to be scheduled on a regular basis to ensure it doesn't keep grabbing the old search data.

0 Karma

glancaster
Path Finder

Hi Shane,

I appreciate the response. I can take the saved search and get the results I want in free form search, but when I was letting the dashboard populate it was stuck on a previous time range. Luckily I saved the previous version and was able to just revert back for the time being.

0 Karma
Get Updates on the Splunk Community!

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...

Explore the Latest Educational Offerings from Splunk [January 2025 Updates]

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...