Dashboards & Visualizations

Deployment Monitor Forwarder Warnings

glancaster
Path Finder

So I check Deployment monitor daily to get a quick overview of my environment. What I'm seeing after I upgraded, is the 'dm missing forwarders' search that runs the Forwarder Warnings dashboard panel is reporting "3d ago" which is when I upgraded the app.

I checked the saved search 'dm missing forwarders' and verified the time range is set to Start time = -24h and Finish Time = now

Running it manually works fine but the dashboard panel reports "3d ago". Has anyone seen anything like this? Is there a way to purge the dashboard panels saved results?

0 Karma

ShaneNewman
Motivator

The saved searches that power the dashboards should update on a regular basis. If you want to refresh them more often, go into the savedsearches.conf of that app and update the frequency of when the searches run to update the dashboards.

0 Karma

ShaneNewman
Motivator

The module should look something like this:

    <module name="HiddenSavedSearch" layoutPanel="panel_row5_col1">
      <param name="savedSearch">_capsule_details_search</param>
      <param name="useHistory">True</param>

You will just need your savedsearch to be scheduled on a regular basis to ensure it doesn't keep grabbing the old search data.

0 Karma

glancaster
Path Finder

Hi Shane,

I appreciate the response. I can take the saved search and get the results I want in free form search, but when I was letting the dashboard populate it was stuck on a previous time range. Luckily I saved the previous version and was able to just revert back for the time being.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...