Missing Data in the Dashboard Tile

[jaibalaraman]

Hi All 

We have created a dashboard to monitor CCTV and it was working fine. However suddenly data stopped populating.  We have done any change. 

My finding 

1 - If i select last 30 days i can see the dashboard working fine 

2 - If i select time range last 20 days i can the dashboard is not working

3 - Started trouble shooting the issue and found the below 

Spl query

The below works fine when the time range is last 30 days 

working - index=test 1sourcetype="stream" NOT upsModel=*1234*
|rename Device AS "UPS "
|rename Model AS "UPS Model"
|rename MinRemaining AS "Runtime Remaining"
|replace 3 WITH Utility, 4 WITH Bypass IN "Input Source"
|sort "Runtime Remaining"
|dedup "UPS Name"
|table "UPS Name" "UPS Model" "Runtime Remaining" "Source" "Location"

Note- The same spl query dont work when time range is last 20 days. 

Trouble shooting - Splunk receiving data till date however i have notice few thing, 

When i select last 30 days i can see the by fields in the search 

UPS Name , UPS Model , Runtime Remaining , Source

When i select last 20 days the below fields are missing not sure why? 

Missing fields - UPS Name , UPS Model , Runtime Remaining , Source . So the below SPL query is not showing any data 

index=test 1sourcetype="stream" NOT upsModel=*1234*
|rename Device AS "UPS "
|rename Model AS "UPS Model"
|rename MinRemaining AS "Runtime Remaining"
|replace 3 WITH Utility, 4 WITH Bypass IN "Input Source"
|sort "Runtime Remaining"
|dedup "UPS Name" - 
|table "UPS Name" "UPS Model" "Runtime Remaining" "Source" "Location"

The highlighted part not pulling any data due to missing field.

Thanks 

[ITWhisperer]

Check your index to see when data was last entered

| metadata type=sourcetypes index=test
| fieldformat recentTime=strftime(recentTime,"%F %T")
| fieldformat firstTime=strftime(firstTime,"%F %T")
| fieldformat lastTime=strftime(lastTime,"%F %T")

[jaibalaraman]

[jaibalaraman]

[ITWhisperer]

Try this over last 30 days

index=*
| timechart span=1d count by sourcetype

[ITWhisperer]

What do you get if you set the timeframe for that search to be last 30 days?