Dashboards & Visualizations

Query for checking on failed dashboard loads

spammenot66
Contributor

I'd like to know if there's a way to get alerted if a dashboard is not performing as expected for a user. How do i query for list of all reports that are throwing errors in a dashboard? Is that possible?

0 Karma

woodcock
Esteemed Legend

One of the things that you can do is look for searches that end in a Finalized state instead of a Done state. That is what happens when a search (loading a dashboard panel or otherwise) is terminated due to system constraints and the data returned is truncated (without any notification of such).

0 Karma

sumanssah
Communicator

Try exploring _internal logs

For reference on dashboard load error, try exploring below-mentioned Query

index=_internal source=*/web_access.log* status=4* | stats count by status
0 Karma

spammenot66
Contributor

@to4kawa - Im interested in knowing if theres an internal log that will help me track down when a dashboard does not load up properly. For example, if the dashboard has reports with errors (for whatever reason - improper regex, an artifact is not available or is not loading up, user has met search or disk quota, etc..)

Is it possible to determine error rate or info by dashboard / report?

0 Karma

to4kawa
Ultra Champion

if a dashboard is not performing as expected for a user.
How's this?

0 Karma
Get Updates on the Splunk Community!

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...