Dashboards & Visualizations

Deployment Monitor Forwarder Warnings

glancaster
Path Finder

So I check Deployment monitor daily to get a quick overview of my environment. What I'm seeing after I upgraded, is the 'dm missing forwarders' search that runs the Forwarder Warnings dashboard panel is reporting "3d ago" which is when I upgraded the app.

I checked the saved search 'dm missing forwarders' and verified the time range is set to Start time = -24h and Finish Time = now

Running it manually works fine but the dashboard panel reports "3d ago". Has anyone seen anything like this? Is there a way to purge the dashboard panels saved results?

0 Karma

ShaneNewman
Motivator

The saved searches that power the dashboards should update on a regular basis. If you want to refresh them more often, go into the savedsearches.conf of that app and update the frequency of when the searches run to update the dashboards.

0 Karma

ShaneNewman
Motivator

The module should look something like this:

    <module name="HiddenSavedSearch" layoutPanel="panel_row5_col1">
      <param name="savedSearch">_capsule_details_search</param>
      <param name="useHistory">True</param>

You will just need your savedsearch to be scheduled on a regular basis to ensure it doesn't keep grabbing the old search data.

0 Karma

glancaster
Path Finder

Hi Shane,

I appreciate the response. I can take the saved search and get the results I want in free form search, but when I was letting the dashboard populate it was stuck on a previous time range. Luckily I saved the previous version and was able to just revert back for the time being.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...