Dashboards & Visualizations

How to troubleshoot dashboard not showing panels as expected?

Mohsin123
Path Finder

Hi, we have an app where one dashboard doesn't come up with the expected results. It either doesn't load fully or says no results found. I have created a test user for that app and was checking ... still the issue is there. Can you please help me how to troubleshoot?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi shraddhamuduli,
your question is rather vague, but I'll try to share some idea:
the process to create a dashboard I use is something like this:

  • at first write on a document what you expect from each panel and create a general mockup of you dashboard (at least in your mind),
  • after create a search for each panel to exactly extract the result you like,
  • then think to output (stats, timechart, table).

Now you can check your result compating them with the starting document, if there are differences or the search doesn't run as you like, come back to debug your search,
delete a part of your search starting by the end until the first pipe "|": if the result is the one you like, you have found the point of the problem, otherwise, continue to delete another part of your search from the end to the first pipe you find.

Put special attention to "search", "where" and "dedup" commands and remember that after a stats command you haven't all the fields!

Another attention point is time period: in test don't use "now" as latest because results could change for new ingested logs, instead use always a fixed period (e.g. yesterday or last hour) but never "now".

If you share your search I could try to help you.

Bye.
Giuseppe

View solution in original post

0 Karma

cmerriman
Super Champion

is everyone using the same browser? i have noticed that sometimes there are failures with IE.

have you made sure all the users have permissions to the same data sets? If one user (test user for instance) doesn't have access to the exact same data set as everyone else, some data will be missing.

0 Karma

Mohsin123
Path Finder

Thankyou so much. I investigated something.. Historical searched reached maximum concurrent searches. Limit =xy.. Is this responsible?

0 Karma

cmerriman
Super Champion

how many searches/subsearches are in this dashboard?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi shraddhamuduli,
your question is rather vague, but I'll try to share some idea:
the process to create a dashboard I use is something like this:

  • at first write on a document what you expect from each panel and create a general mockup of you dashboard (at least in your mind),
  • after create a search for each panel to exactly extract the result you like,
  • then think to output (stats, timechart, table).

Now you can check your result compating them with the starting document, if there are differences or the search doesn't run as you like, come back to debug your search,
delete a part of your search starting by the end until the first pipe "|": if the result is the one you like, you have found the point of the problem, otherwise, continue to delete another part of your search from the end to the first pipe you find.

Put special attention to "search", "where" and "dedup" commands and remember that after a stats command you haven't all the fields!

Another attention point is time period: in test don't use "now" as latest because results could change for new ingested logs, instead use always a fixed period (e.g. yesterday or last hour) but never "now".

If you share your search I could try to help you.

Bye.
Giuseppe

0 Karma

Mohsin123
Path Finder

Hi Cusello ,

I have dashboard ! problem is sometimes data comes fully sometimes page doesnt load fully thats my issue.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...