Dashboards & Visualizations

Hidden Search only showing one hours data

Path Finder

I have a dashboard with a hidden search defined the results from which are used to drive a number of charts. I have the earliest time set to -6h to give a reasonable view on the data I have summarised at 5 minute intervals.

When I look at the dashboard only the data from the last hour is shown in the charts on the dashboard. If I take the same search and run it manually I get results from all of the 6 hour period and replicating the charting from that manual search gives me the charts I expect.

The hidden search is defined as follows:


index=summary report="gad_dashboard_report" | bin _time span=5min
-6h

This is then used in various PostProcby various HiddenPostProcess modules in my dashboard. Can anyone explain how to get the whole 6 hour period rather than only the last hour?

The charts have a six hour period on them, just no data. The 6 hour search returns around 1000 matching events. Changing the earliest time value to 3 hours adjusts the size of the charts, the timeline is reduced from 6 hours to 3, but doesn't result in any more data being seen.

1 Solution

Path Finder

This turned out to be an event limit in the hidden search. If I changed the searches to not be hidden ones then I got the full set of results for the graphs.

View solution in original post

0 Karma

Path Finder

This turned out to be an event limit in the hidden search. If I changed the searches to not be hidden ones then I got the full set of results for the graphs.

View solution in original post

0 Karma

Path Finder

Try with another span: Probably splunk cannot show more than 1 hour with a 5 minute span.

0 Karma

Champion

what happens if you delete the earliest param and put the earliest command into the search, e.g;

<module name="HiddenSearch" layoutpanel="panel_row2_col1" autorun="True">
    <param name="search">index=summary report="gad_dashboard_report" earliest=-6h | bin _time span=5min</param>
0 Karma

Path Finder

Sadly it makes no difference at all. I still only see the last hour worth of results in the graphs.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!