Dashboards & Visualizations

Real Time Dashboard issues

Path Finder

Hi,

I've built a real time dashboard but I am seeing some strange issues.
So on the dashboard page itself, it displays perfectly without any issues.
But when I make it my home dashboard, the time inverts and starts showing the oldest events at the top.

I have no idea why this is happening.

Below are some screenshots of the search and the time settings.

Dashboard view

Home page dashboard

0 Karma

SplunkTrust
SplunkTrust

try in ascending order sort _time
also can you try | rtorder discard=t ?
Also try | sort -_indextime

let me know if any of the above works!

0 Karma

Path Finder

Hi there, I tried | rtorder discard=t and it sorted it!
Are you able to explain what this statement does? Or maybe there is documentation on it?

Thanks for the help!

0 Karma

SplunkTrust
SplunkTrust

Yes there is a good documentation on rtorder command
https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Rtorder

Accept the answer if it solves your problem!

0 Karma

Path Finder

I cannot post anymore photos, so here is the search:

severity_name=alert OR severity_level=alert OR severity_name=critical OR severity_level=critical OR severity_name=emergency OR severity_level=emergency OR severity_name=error OR severity_level=error OR severity_name=informational OR severity_level=informational OR severity_name=notification OR severity_level=notification OR severity_name=warning OR severity_level=warning |fields eventtype

The time is set to: rt-23h & rtnow

0 Karma

SplunkTrust
SplunkTrust

can you try sort- 0 Time at the end of the search?

0 Karma

Path Finder

Hi There,

Sorry I should have said I was added sort - _time at the end of the search and it didn't make a difference.

Interestingly, it seems to have sorted itself out. I'm nt sure if there is some sort of delay or something like that. I've found the custom dashboards to be fairly difficult to set up.

0 Karma

SplunkTrust
SplunkTrust

can you provide entire query?

0 Karma

Path Finder

Sorry what do you mean the entire query?
The only thing I'm searching is with severity_name=alert OR severity_level=alert OR severity_name=critical OR severity_level=critical OR severity_name=emergency OR severity_level=emergency OR severity_name=error OR severity_level=error OR severity_name=informational OR severity_level=informational OR severity_name=notification OR severity_level=notification OR severity_name=warning OR severity_level=warning |fields eventtype

0 Karma