Dashboards & Visualizations

Why is the dashboard result different in production and acceptance environment?

patmarton
New Member

Hello Splunkers,

I created a dashboard in splunk which is working fine based on our tests. When I moved it to production environment it shows false data. After going through the logs i found out that the exact same code shows duplicated values in the production environment.

I noticed that the code is fine, but after the following command, it shows duplicated values :

| stats list(RunTime) AS Run , avg(seconds) AS Average by SiteName, Country, SiteRegion

So the result before this line is:

**SiteName**  **RunTime**

Prague         10.9
Prague         10.2
Prague         19.8

And the result after that line is:

**SiteName**  **RunTime**

Prague         10.9
Prague         10.9
Prague         10.9
Prague         10.9
Prague         19.8
Prague         19.8
Prague         19.8
Prague         19.8

And so on.

I cannot really figure out why it happens, and also looking for a better solution than the dedup command.

Thank you.

Tags (3)
0 Karma

kmaron
Motivator

if you use values instead of list it will remove duplicates.

0 Karma

patmarton
New Member

Thank you for your answer. I do not really want to remove duplicates directly because there might be cases where the processing time is the same for different runs.

0 Karma

kmaron
Motivator

Then what is it you're really aiming for?

0 Karma

patmarton
New Member

I need to know why data gets duplicated after that command. I can use dedup or values but in case there were two different runs with the same RunTime, I would lose one of them, and I only want to get rid of the duplicates.

0 Karma
Get Updates on the Splunk Community!

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...