Reporting

"Single value" on dashboard losing formatting in PDF format

JohnRiddoch
Explorer

I've got a report which I've incorporated into a dashboard. It's a "single value" visualisation with a sparkline from a timechart with the number rounded to 3 decimal places and units noted (s for seconds). Everything works fine in the report and on the dashboard via web, but when I schedule PDF delivery, this report loses both the decimal places (numbers are rounded to whole numbers) and the units are lost, so "0.064s" just becomes "0". The sparkline data looks the same on both online & PDF formats, so it looks like the data is still getting reported, but part of the data(fractions & units) is vanishing. The other reports in the dashboard are coming out consistently between online & PDF versions.

Any ideas why this would be the case? Splunk version is 6.5.1.

0 Karma

JohnRiddoch
Explorer

OK, I've found a workaround now. Basically, setting the options on the dashboard (as well as or instead of in the saved report) means it works on both web and PDF dashboards. In the XML:

        <option name="numberPrecision">0.000</option>
        <option name="unit">s</option>

It's a bit of a pain to have to define the settings both in the saved search/report and the dashboard, but at least it's a working solution.
This seems to work fine for savedsearch, inline search and loadjob within the dashboard.

cmerriman
Super Champion

after looking at your xml you provided, i would change a few things and see if it helps:

  <panel>
       <single>
         <title>average page response time - 4 hours</title>
         <search>
             <query> |loadjob savedsearch="JohnRiddoch:search:average page response time - 4 hours"|eval FIELD=round(FIELD,3)."s"</query>
        </search>
       </single>
     </panel>

here is documentation for loadjobs. i like to work with them more than just referencing saved searches, because you can manipulate the search if needed, and at one point, one of my dashboard hit like 50 references and wouldn't export the pdf anymore until i switched them all to loadjobs, so there might be better efficiency, as well.
https://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Loadjob

the syntax is |loadjob savedsearch="usernameOfSearch:appnameOfSearch:searchName"

0 Karma

JohnRiddoch
Explorer

Possibly me doing something wrong, but that's not helping; the eval doesn't seem to do anything in my case, no matter what I try in it and I've lost all the precision even on the online dashboard (it just rounds to the whole number).
What am I missing here? I've even tried running an ad-hoc query in search. From that, it doesn't set the precision in the visualisation unless I specifically set it and adding "s" to the end of the value breaks the sparkline & trend indicators.

0 Karma

cmerriman
Super Champion

when you run the loadjob in search, does it round correctly and add the unit? I'm getting it to work on a test dashboard, but i'm version 6.5.1.

0 Karma

JohnRiddoch
Explorer

I've got

| loadjob savedsearch="jriddoch:search:average page response time - 4 hours"

in the search box and it's not reporting the units or decimal digits. Adding the eval doesn't help either.

I'm on version 6.5.1 as well.

0 Karma

cmerriman
Super Champion

what is your time range you're looking for? i've noticed that for my time window when using loadjob, i have to look at a window greater than when the job actually ran. if it runs every 4 hours, maybe just look for last 24 hours. it'll grab the last job it sees. play with the time range a little bit. On one of mine that runs weekly for a 4 week range, i actually have to search for the last 5 weeks (though i just search all time to be safe and it still comes back in a jiff). see if that helps.

0 Karma

JohnRiddoch
Explorer

The saved search is for the last 4 hours, time picker in the search window when I run loadjob is "All time". Job is currently being run every 5 minutes while I'm debugging this.

0 Karma

cmerriman
Super Champion

even with the it being All Time you aren't getting results? You're getting results or not, any errors? When you open the saved search, are you getting 3 decimal places?

0 Karma

JohnRiddoch
Explorer

I'm getting results out fine; the sparkline looks right and the results table is coming up, it's just that the "single value" in the visualisation isn't getting any decimal places (it's rounded to the whole number). So:
- saved search is working fine and reporting decimal places
- loadjob in search is getting results, but rounding to whole number
- loadjob in dashboard is getting results (on the basis the sparkline is showing data), but rounding to whole number

0 Karma

cmerriman
Super Champion

i'm not sure why the loadjob is only returning a whole number, I've only ever had it return exactly what is in my saved search before. it might have to do with the visualization configurations in the saved search, but i'm not sure.

0 Karma

cmerriman
Super Champion

can you add any detail about how you formatted the number and unit? if it is just something in the xml, that could be why, a lot of formatting doesn't get picked up by the PDF generator and you might need to hardcode the formatting into your search.

0 Karma

JohnRiddoch
Explorer

The saved search is stored as:

[average page response time - 4 hours]
action.email.useNSSubject = 1
alert.track = 0
dispatch.earliest_time = -4h@m
dispatch.latest_time = now
dispatchAs = user
display.events.fields = ["host","source","sourcetype","debug","field_4","app_id","page_id","time_taken","time_to_first_byte"]
display.general.type = visualizations
display.page.search.tab = visualizations
display.statistics.show = 0
display.visualizations.charting.chart = line
display.visualizations.singlevalue.numberPrecision = 0.000
display.visualizations.singlevalue.unit = s
display.visualizations.type = singlevalue
request.ui_dispatch_app = search
request.ui_dispatch_view = search
search = source="/var/log/httpd/REDACTED_log" (page_id=* OR ref_page_id=*) | eval time_in_s=time_taken/1000000 | timechart avg(time_in_s)

time_taken is from the Apache logs and is the time taken in microseconds.
The report is simply embedded into the dashboard XML:

    <panel>
      <single>
        <title>average page response time - 4 hours</title>
        <search ref="average page response time - 4 hours"></search>
      </single>
    </panel>
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...