Dashboards & Visualizations

Hidden Search only showing one hours data

MickSheppard
Path Finder

I have a dashboard with a hidden search defined the results from which are used to drive a number of charts. I have the earliest time set to -6h to give a reasonable view on the data I have summarised at 5 minute intervals.

When I look at the dashboard only the data from the last hour is shown in the charts on the dashboard. If I take the same search and run it manually I get results from all of the 6 hour period and replicating the charting from that manual search gives me the charts I expect.

The hidden search is defined as follows:


index=summary report="gad_dashboard_report" | bin _time span=5min
-6h

This is then used in various PostProcby various HiddenPostProcess modules in my dashboard. Can anyone explain how to get the whole 6 hour period rather than only the last hour?

The charts have a six hour period on them, just no data. The 6 hour search returns around 1000 matching events. Changing the earliest time value to 3 hours adjusts the size of the charts, the timeline is reduced from 6 hours to 3, but doesn't result in any more data being seen.

1 Solution

MickSheppard
Path Finder

This turned out to be an event limit in the hidden search. If I changed the searches to not be hidden ones then I got the full set of results for the graphs.

View solution in original post

0 Karma

MickSheppard
Path Finder

This turned out to be an event limit in the hidden search. If I changed the searches to not be hidden ones then I got the full set of results for the graphs.

0 Karma

dvb
Path Finder

Try with another span: Probably splunk cannot show more than 1 hour with a 5 minute span.

0 Karma

Drainy
Champion

what happens if you delete the earliest param and put the earliest command into the search, e.g;

<module name="HiddenSearch" layoutpanel="panel_row2_col1" autorun="True">
    <param name="search">index=summary report="gad_dashboard_report" earliest=-6h | bin _time span=5min</param>
0 Karma

MickSheppard
Path Finder

Sadly it makes no difference at all. I still only see the last hour worth of results in the graphs.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...