Dashboards & Visualizations

Real Time Dashboard issues

FraserC1
Path Finder

Hi,

I've built a real time dashboard but I am seeing some strange issues.
So on the dashboard page itself, it displays perfectly without any issues.
But when I make it my home dashboard, the time inverts and starts showing the oldest events at the top.

I have no idea why this is happening.

Below are some screenshots of the search and the time settings.

Dashboard view

Home page dashboard

0 Karma

mayurr98
Super Champion

try in ascending order sort _time
also can you try | rtorder discard=t ?
Also try | sort -_indextime

let me know if any of the above works!

0 Karma

FraserC1
Path Finder

Hi there, I tried | rtorder discard=t and it sorted it!
Are you able to explain what this statement does? Or maybe there is documentation on it?

Thanks for the help!

0 Karma

mayurr98
Super Champion

Yes there is a good documentation on rtorder command
https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Rtorder

Accept the answer if it solves your problem!

0 Karma

FraserC1
Path Finder

I cannot post anymore photos, so here is the search:

severity_name=alert OR severity_level=alert OR severity_name=critical OR severity_level=critical OR severity_name=emergency OR severity_level=emergency OR severity_name=error OR severity_level=error OR severity_name=informational OR severity_level=informational OR severity_name=notification OR severity_level=notification OR severity_name=warning OR severity_level=warning |fields eventtype

The time is set to: rt-23h & rtnow

0 Karma

mayurr98
Super Champion

can you try sort- 0 Time at the end of the search?

0 Karma

FraserC1
Path Finder

Hi There,

Sorry I should have said I was added sort - _time at the end of the search and it didn't make a difference.

Interestingly, it seems to have sorted itself out. I'm nt sure if there is some sort of delay or something like that. I've found the custom dashboards to be fairly difficult to set up.

0 Karma

mayurr98
Super Champion

can you provide entire query?

0 Karma

FraserC1
Path Finder

Sorry what do you mean the entire query?
The only thing I'm searching is with severity_name=alert OR severity_level=alert OR severity_name=critical OR severity_level=critical OR severity_name=emergency OR severity_level=emergency OR severity_name=error OR severity_level=error OR severity_name=informational OR severity_level=informational OR severity_name=notification OR severity_level=notification OR severity_name=warning OR severity_level=warning |fields eventtype

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...