Splunk Search

Dashboard not showing correct results

KevinAdu
Explorer

Hello,

I have created a dashboard with some very simple searches, for example:

index=something | stats count

In our dashboard every time it is run the results seem to vary. When run in the search bar we seem to consistently get the same result as expected. After a bit of research I realised that dashboards are run in Fast Mode. So I decided to change the dashboards so that they run in Verbose mode. The way I have done that was changing the dashboard to HTML and adding the following line to the search managers in the JavaScript portion:

"adhoc_search_level": "verbose"

Now after adding this, the correct results consistently show in dashboards. This is undesirable as it make the dashboards a bit difficult for us to change and other reasons.

So my questions are:

1) Why is this happening? Surely depending on what mode you run your search in, it shouldn't affect the results.
2) Is there any other way to solve this without converting my dashboard into an HTML one?

Thanks for you time.

0 Karma

MuS
Legend

Hi KevinAdu,

  1. read the docs about the search modes http://docs.splunk.com/Documentation/Splunk/6.2.5/Search/Changethesearchmode and how they effect field extractions.
  2. not sure on this, using simple XML and I never had such a problem.

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...