Dashboards & Visualizations

Verbose mode on Dashboard report

VipeRafajzat
Explorer

Hello!

I have a problem with dashboard reports where the verbose mode shows the latest data, while the fast/smart which is somehow the default, shows like 10 minutes old data. I tried a couple of settings and even change my query, but nothing helped. If I restart the splunk, then the data is ok for a couple of minutes, then it will start to show delayed the data. Does anyone can advise what needs to be changed in order to run always in verbose mode?

 

index=MYINDEX
| lookup code_lookup code OUTPUTNEW t_name 
| eval code=IF(ISNULL(t_name),code,t_name) 
| lookup v_lookup v OUTPUTNEW v_name 
| eval v=IF(ISNULL(v_name),v,v_name) 
| eval CMinutes = ceil(duration / 60) 
| rex field=d_num mode=sed "s/(\d{4,})[0-9#]{4}$/\1####/g"
| rename date as Date-mmddyy, time as Time, tag::cond_code as "CType", c_num as "C Number", d_num as "D Number", duration as "Seconds", CMinutes as "Minutes", code_used as Trunk, vdn as VDN 
| table Date-mmddyy, Time, "CType", "Seconds", "CMinutes", "CNumber", "DNumber", T, V 
| fields Date-mmddyy, Time, "CType", "Seconds", "CMinutes", "CNumber", "DNumber", T, V 
| head 100
| sort -Time

 

 Thank you!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What do you mean by delayed data? Is it that your search needs the refresh and refreshType child elements?

https://docs.splunk.com/Documentation/Splunk/8.1.0/Viz/PanelreferenceforSimplifiedXML#search

0 Karma

VipeRafajzat
Explorer

Actually I am looking for real-time data here. After some time the time start to be delayed, so like 10 minutes old data start to show up instead of real-time. 

If I run the query manually in fast-mode the data showing some delay, but not real time, but when I am running it as verbose, the data is real-time as it should be.

 

The index reads the data from a .csv which is getting updated from a remote system.

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...