Reporting

"Single value" on dashboard losing formatting in PDF format

Explorer

I've got a report which I've incorporated into a dashboard. It's a "single value" visualisation with a sparkline from a timechart with the number rounded to 3 decimal places and units noted (s for seconds). Everything works fine in the report and on the dashboard via web, but when I schedule PDF delivery, this report loses both the decimal places (numbers are rounded to whole numbers) and the units are lost, so "0.064s" just becomes "0". The sparkline data looks the same on both online & PDF formats, so it looks like the data is still getting reported, but part of the data(fractions & units) is vanishing. The other reports in the dashboard are coming out consistently between online & PDF versions.

Any ideas why this would be the case? Splunk version is 6.5.1.

0 Karma

Explorer

OK, I've found a workaround now. Basically, setting the options on the dashboard (as well as or instead of in the saved report) means it works on both web and PDF dashboards. In the XML:

        <option name="numberPrecision">0.000</option>
        <option name="unit">s</option>

It's a bit of a pain to have to define the settings both in the saved search/report and the dashboard, but at least it's a working solution.
This seems to work fine for savedsearch, inline search and loadjob within the dashboard.

Super Champion

after looking at your xml you provided, i would change a few things and see if it helps:

  <panel>
       <single>
         <title>average page response time - 4 hours</title>
         <search>
             <query> |loadjob savedsearch="JohnRiddoch:search:average page response time - 4 hours"|eval FIELD=round(FIELD,3)."s"</query>
        </search>
       </single>
     </panel>

here is documentation for loadjobs. i like to work with them more than just referencing saved searches, because you can manipulate the search if needed, and at one point, one of my dashboard hit like 50 references and wouldn't export the pdf anymore until i switched them all to loadjobs, so there might be better efficiency, as well.
https://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Loadjob

the syntax is |loadjob savedsearch="usernameOfSearch:appnameOfSearch:searchName"

0 Karma

Explorer

Possibly me doing something wrong, but that's not helping; the eval doesn't seem to do anything in my case, no matter what I try in it and I've lost all the precision even on the online dashboard (it just rounds to the whole number).
What am I missing here? I've even tried running an ad-hoc query in search. From that, it doesn't set the precision in the visualisation unless I specifically set it and adding "s" to the end of the value breaks the sparkline & trend indicators.

0 Karma

Super Champion

when you run the loadjob in search, does it round correctly and add the unit? I'm getting it to work on a test dashboard, but i'm version 6.5.1.

0 Karma

Explorer

I've got

| loadjob savedsearch="jriddoch:search:average page response time - 4 hours"

in the search box and it's not reporting the units or decimal digits. Adding the eval doesn't help either.

I'm on version 6.5.1 as well.

0 Karma

Super Champion

what is your time range you're looking for? i've noticed that for my time window when using loadjob, i have to look at a window greater than when the job actually ran. if it runs every 4 hours, maybe just look for last 24 hours. it'll grab the last job it sees. play with the time range a little bit. On one of mine that runs weekly for a 4 week range, i actually have to search for the last 5 weeks (though i just search all time to be safe and it still comes back in a jiff). see if that helps.

0 Karma

Explorer

The saved search is for the last 4 hours, time picker in the search window when I run loadjob is "All time". Job is currently being run every 5 minutes while I'm debugging this.

0 Karma

Super Champion

even with the it being All Time you aren't getting results? You're getting results or not, any errors? When you open the saved search, are you getting 3 decimal places?

0 Karma

Explorer

I'm getting results out fine; the sparkline looks right and the results table is coming up, it's just that the "single value" in the visualisation isn't getting any decimal places (it's rounded to the whole number). So:
- saved search is working fine and reporting decimal places
- loadjob in search is getting results, but rounding to whole number
- loadjob in dashboard is getting results (on the basis the sparkline is showing data), but rounding to whole number

0 Karma

Super Champion

i'm not sure why the loadjob is only returning a whole number, I've only ever had it return exactly what is in my saved search before. it might have to do with the visualization configurations in the saved search, but i'm not sure.

0 Karma

Super Champion

can you add any detail about how you formatted the number and unit? if it is just something in the xml, that could be why, a lot of formatting doesn't get picked up by the PDF generator and you might need to hardcode the formatting into your search.

0 Karma

Explorer

The saved search is stored as:

[average page response time - 4 hours]
action.email.useNSSubject = 1
alert.track = 0
dispatch.earliest_time = -4h@m
dispatch.latest_time = now
dispatchAs = user
display.events.fields = ["host","source","sourcetype","debug","field_4","app_id","page_id","time_taken","time_to_first_byte"]
display.general.type = visualizations
display.page.search.tab = visualizations
display.statistics.show = 0
display.visualizations.charting.chart = line
display.visualizations.singlevalue.numberPrecision = 0.000
display.visualizations.singlevalue.unit = s
display.visualizations.type = singlevalue
request.ui_dispatch_app = search
request.ui_dispatch_view = search
search = source="/var/log/httpd/REDACTED_log" (page_id=* OR ref_page_id=*) | eval time_in_s=time_taken/1000000 | timechart avg(time_in_s)

time_taken is from the Apache logs and is the time taken in microseconds.
The report is simply embedded into the dashboard XML:

    <panel>
      <single>
        <title>average page response time - 4 hours</title>
        <search ref="average page response time - 4 hours"></search>
      </single>
    </panel>
0 Karma