Dashboards & Visualizations

Query for checking on failed dashboard loads

spammenot66
Contributor

I'd like to know if there's a way to get alerted if a dashboard is not performing as expected for a user. How do i query for list of all reports that are throwing errors in a dashboard? Is that possible?

0 Karma

woodcock
Esteemed Legend

One of the things that you can do is look for searches that end in a Finalized state instead of a Done state. That is what happens when a search (loading a dashboard panel or otherwise) is terminated due to system constraints and the data returned is truncated (without any notification of such).

0 Karma

sumanssah
Communicator

Try exploring _internal logs

For reference on dashboard load error, try exploring below-mentioned Query

index=_internal source=*/web_access.log* status=4* | stats count by status
0 Karma

spammenot66
Contributor

@to4kawa - Im interested in knowing if theres an internal log that will help me track down when a dashboard does not load up properly. For example, if the dashboard has reports with errors (for whatever reason - improper regex, an artifact is not available or is not loading up, user has met search or disk quota, etc..)

Is it possible to determine error rate or info by dashboard / report?

0 Karma

to4kawa
Ultra Champion

if a dashboard is not performing as expected for a user.
How's this?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Data Outage Monitoring and Reporting

We’ve all been there, right? Living our best life, working on our Splunk environment, when out of nowhere a ...

Manage Datasets and Connections in Catalog on Splunk Cloud Platform

Set Up Data Where You Use It Catalog already helps teams find and understand data across Splunk indexes, ...

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...