Real Time Dashboard issues

[FraserC1]

Hi,

I've built a real time dashboard but I am seeing some strange issues.
So on the dashboard page itself, it displays perfectly without any issues.
But when I make it my home dashboard, the time inverts and starts showing the oldest events at the top.

I have no idea why this is happening.

Below are some screenshots of the search and the time settings.

[mayurr98]

try in ascending order sort _time
also can you try | rtorder discard=t ?
Also try | sort -_indextime

let me know if any of the above works!

[FraserC1]

Hi there, I tried | rtorder discard=t and it sorted it!
Are you able to explain what this statement does? Or maybe there is documentation on it?

Thanks for the help!

[mayurr98]

Yes there is a good documentation on rtorder command
https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Rtorder

Accept the answer if it solves your problem!

[FraserC1]

I cannot post anymore photos, so here is the search:

severity_name=alert OR severity_level=alert OR severity_name=critical OR severity_level=critical OR severity_name=emergency OR severity_level=emergency OR severity_name=error OR severity_level=error OR severity_name=informational OR severity_level=informational OR severity_name=notification OR severity_level=notification OR severity_name=warning OR severity_level=warning |fields eventtype

The time is set to: rt-23h & rtnow

[mayurr98]

can you try sort- 0 Time at the end of the search?

[FraserC1]

Hi There,

Sorry I should have said I was added sort - _time at the end of the search and it didn't make a difference.

Interestingly, it seems to have sorted itself out. I'm nt sure if there is some sort of delay or something like that. I've found the custom dashboards to be fairly difficult to set up.

[mayurr98]

can you provide entire query?

[FraserC1]

Sorry what do you mean the entire query?
The only thing I'm searching is with severity_name=alert OR severity_level=alert OR severity_name=critical OR severity_level=critical OR severity_name=emergency OR severity_level=emergency OR severity_name=error OR severity_level=error OR severity_name=informational OR severity_level=informational OR severity_name=notification OR severity_level=notification OR severity_name=warning OR severity_level=warning |fields eventtype