Splunk version : 6.4.2
I have dashboards that display historic data (last 18 months of data) grouped at the month level. In my developer box , I am able to see the 18 months of data. But in Production environment, it shows only 3-4 months of data. I ran different searches with earliest/latest options and i saw that in production, it always gives only about 100 days of data in dashboards.
When i did the same using search box, i realized that if i change the search mode to verbose, it gives me all the data. My searches are transforming searches that use timechart. Now how do i set the search mode to verbose in Simple XML and in HTML dashboards?
If that cannot be set (which is want some other Splunk answers were saying), then is there a workaround to this? Can i run this query in background in verbose mode and show the already calculated results? (My data is not dynamic. these reports are at monthly level and the view changes once in a month only).
==Edit==
I added the query sample below.
source="*InputData.csv" earliest=-18mon | timechart span=1mon avg(fieldA) as AvgOfFieldA
==End-Edit===
Thanks,
Senthil Nathan
... View more