Dashboards & Visualizations

Real Time Dashboard issues

FraserC1
Path Finder

Hi,

I've built a real time dashboard but I am seeing some strange issues.
So on the dashboard page itself, it displays perfectly without any issues.
But when I make it my home dashboard, the time inverts and starts showing the oldest events at the top.

I have no idea why this is happening.

Below are some screenshots of the search and the time settings.

Dashboard view

Home page dashboard

0 Karma

mayurr98
Super Champion

try in ascending order sort _time
also can you try | rtorder discard=t ?
Also try | sort -_indextime

let me know if any of the above works!

0 Karma

FraserC1
Path Finder

Hi there, I tried | rtorder discard=t and it sorted it!
Are you able to explain what this statement does? Or maybe there is documentation on it?

Thanks for the help!

0 Karma

mayurr98
Super Champion

Yes there is a good documentation on rtorder command
https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Rtorder

Accept the answer if it solves your problem!

0 Karma

FraserC1
Path Finder

I cannot post anymore photos, so here is the search:

severity_name=alert OR severity_level=alert OR severity_name=critical OR severity_level=critical OR severity_name=emergency OR severity_level=emergency OR severity_name=error OR severity_level=error OR severity_name=informational OR severity_level=informational OR severity_name=notification OR severity_level=notification OR severity_name=warning OR severity_level=warning |fields eventtype

The time is set to: rt-23h & rtnow

0 Karma

mayurr98
Super Champion

can you try sort- 0 Time at the end of the search?

0 Karma

FraserC1
Path Finder

Hi There,

Sorry I should have said I was added sort - _time at the end of the search and it didn't make a difference.

Interestingly, it seems to have sorted itself out. I'm nt sure if there is some sort of delay or something like that. I've found the custom dashboards to be fairly difficult to set up.

0 Karma

mayurr98
Super Champion

can you provide entire query?

0 Karma

FraserC1
Path Finder

Sorry what do you mean the entire query?
The only thing I'm searching is with severity_name=alert OR severity_level=alert OR severity_name=critical OR severity_level=critical OR severity_name=emergency OR severity_level=emergency OR severity_name=error OR severity_level=error OR severity_name=informational OR severity_level=informational OR severity_name=notification OR severity_level=notification OR severity_name=warning OR severity_level=warning |fields eventtype

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...