I've got a report which I've incorporated into a dashboard. It's a "single value" visualisation with a sparkline from a timechart with the number rounded to 3 decimal places and units noted (s for seconds). Everything works fine in the report and on the dashboard via web, but when I schedule PDF delivery, this report loses both the decimal places (numbers are rounded to whole numbers) and the units are lost, so "0.064s" just becomes "0". The sparkline data looks the same on both online & PDF formats, so it looks like the data is still getting reported, but part of the data(fractions & units) is vanishing. The other reports in the dashboard are coming out consistently between online & PDF versions.
Any ideas why this would be the case? Splunk version is 6.5.1.
OK, I've found a workaround now. Basically, setting the options on the dashboard (as well as or instead of in the saved report) means it works on both web and PDF dashboards. In the XML:
<option name="numberPrecision">0.000</option> <option name="unit">s</option>
It's a bit of a pain to have to define the settings both in the saved search/report and the dashboard, but at least it's a working solution.
This seems to work fine for savedsearch, inline search and loadjob within the dashboard.
after looking at your xml you provided, i would change a few things and see if it helps:
<panel> <single> <title>average page response time - 4 hours</title> <search> <query> |loadjob savedsearch="JohnRiddoch:search:average page response time - 4 hours"|eval FIELD=round(FIELD,3)."s"</query> </search> </single> </panel>
here is documentation for loadjobs. i like to work with them more than just referencing saved searches, because you can manipulate the search if needed, and at one point, one of my dashboard hit like 50 references and wouldn't export the pdf anymore until i switched them all to loadjobs, so there might be better efficiency, as well.
the syntax is
Possibly me doing something wrong, but that's not helping; the eval doesn't seem to do anything in my case, no matter what I try in it and I've lost all the precision even on the online dashboard (it just rounds to the whole number).
What am I missing here? I've even tried running an ad-hoc query in search. From that, it doesn't set the precision in the visualisation unless I specifically set it and adding "s" to the end of the value breaks the sparkline & trend indicators.
| loadjob savedsearch="jriddoch:search:average page response time - 4 hours"
in the search box and it's not reporting the units or decimal digits. Adding the eval doesn't help either.
I'm on version 6.5.1 as well.
what is your time range you're looking for? i've noticed that for my time window when using loadjob, i have to look at a window greater than when the job actually ran. if it runs every 4 hours, maybe just look for last 24 hours. it'll grab the last job it sees. play with the time range a little bit. On one of mine that runs weekly for a 4 week range, i actually have to search for the last 5 weeks (though i just search all time to be safe and it still comes back in a jiff). see if that helps.
I'm getting results out fine; the sparkline looks right and the results table is coming up, it's just that the "single value" in the visualisation isn't getting any decimal places (it's rounded to the whole number). So:
- saved search is working fine and reporting decimal places
- loadjob in search is getting results, but rounding to whole number
- loadjob in dashboard is getting results (on the basis the sparkline is showing data), but rounding to whole number
i'm not sure why the loadjob is only returning a whole number, I've only ever had it return exactly what is in my saved search before. it might have to do with the visualization configurations in the saved search, but i'm not sure.
can you add any detail about how you formatted the number and unit? if it is just something in the xml, that could be why, a lot of formatting doesn't get picked up by the PDF generator and you might need to hardcode the formatting into your search.
The saved search is stored as:
[average page response time - 4 hours] action.email.useNSSubject = 1 alert.track = 0 dispatch.earliest_time = -4h@m dispatch.latest_time = now dispatchAs = user display.events.fields = ["host","source","sourcetype","debug","field_4","app_id","page_id","time_taken","time_to_first_byte"] display.general.type = visualizations display.page.search.tab = visualizations display.statistics.show = 0 display.visualizations.charting.chart = line display.visualizations.singlevalue.numberPrecision = 0.000 display.visualizations.singlevalue.unit = s display.visualizations.type = singlevalue request.ui_dispatch_app = search request.ui_dispatch_view = search search = source="/var/log/httpd/REDACTED_log" (page_id=* OR ref_page_id=*) | eval time_in_s=time_taken/1000000 | timechart avg(time_in_s)
time_taken is from the Apache logs and is the time taken in microseconds.
The report is simply embedded into the dashboard XML:
<panel> <single> <title>average page response time - 4 hours</title> <search ref="average page response time - 4 hours"></search> </single> </panel>