Facing issues with Reports

[Amit79]

Hello All,

I  am calculating burnrate in splunk,  and using addinfo for enrichment to display it on the dashboard.

Burnrate is getting calculated but previous day burnrate is not getting stored which splunk could refer.

I am running the report and pushing the values to it using outputlookup command, &  from there below script is reading it.

In Dev environment its working fine, but when  I am moving to production its breaking, the values are getting calculated but nit getting saved and burnrate values are not getting connected as per below graph.

Here is the script

| inputlookup append=t lkp_add.csv | addinfo
| eval timestamp=if(isnull(timestamp),round(strptime(date + " 23:59:59","%Y-%m-%d %H:%M:%S"), 0), timestamp), threshold=1
| where desc="add info" and timestamp>=(now()-(info_max_time-info_min_time))
| stats max(burnrate) as burnrate max(threshold) as threshold by timestamp
| eval _time=strptime(timestamp,"%s") | timechart max(burnrate) as burnrate max(threshold) as threshold

Amit79_0-1696287422260.png

[inventsekar]

Hi @Amit79 ... as you are saying its working fine in Dev and its not working in prod.. so something missing /wrong in the prod environment. 

Pls confirm the lookup file in prod if its having yesterdays data or not.. pls compare dev and prod for the lookup file, search command.. etc.. thanks.