Dashboards & Visualizations

Verbose mode on Dashboard report

VipeRafajzat
Explorer

Hello!

I have a problem with dashboard reports where the verbose mode shows the latest data, while the fast/smart which is somehow the default, shows like 10 minutes old data. I tried a couple of settings and even change my query, but nothing helped. If I restart the splunk, then the data is ok for a couple of minutes, then it will start to show delayed the data. Does anyone can advise what needs to be changed in order to run always in verbose mode?

 

index=MYINDEX
| lookup code_lookup code OUTPUTNEW t_name 
| eval code=IF(ISNULL(t_name),code,t_name) 
| lookup v_lookup v OUTPUTNEW v_name 
| eval v=IF(ISNULL(v_name),v,v_name) 
| eval CMinutes = ceil(duration / 60) 
| rex field=d_num mode=sed "s/(\d{4,})[0-9#]{4}$/\1####/g"
| rename date as Date-mmddyy, time as Time, tag::cond_code as "CType", c_num as "C Number", d_num as "D Number", duration as "Seconds", CMinutes as "Minutes", code_used as Trunk, vdn as VDN 
| table Date-mmddyy, Time, "CType", "Seconds", "CMinutes", "CNumber", "DNumber", T, V 
| fields Date-mmddyy, Time, "CType", "Seconds", "CMinutes", "CNumber", "DNumber", T, V 
| head 100
| sort -Time

 

 Thank you!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What do you mean by delayed data? Is it that your search needs the refresh and refreshType child elements?

https://docs.splunk.com/Documentation/Splunk/8.1.0/Viz/PanelreferenceforSimplifiedXML#search

0 Karma

VipeRafajzat
Explorer

Actually I am looking for real-time data here. After some time the time start to be delayed, so like 10 minutes old data start to show up instead of real-time. 

If I run the query manually in fast-mode the data showing some delay, but not real time, but when I am running it as verbose, the data is real-time as it should be.

 

The index reads the data from a .csv which is getting updated from a remote system.

0 Karma
Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...