Hi All We have created a dashboard to monitor CCTV and it was working fine. However suddenly data stopped populating. We have done any change. My finding 1 - If i select last 30 days i can see the dashboard working fine 2 - If i select time range last 20 days i can the dashboard is not working 3 - Started trouble shooting the issue and found the below Spl query The below works fine when the time range is last 30 days working - index=test 1sourcetype="stream" NOT upsModel=*1234* |rename Device AS "UPS " |rename Model AS "UPS Model" |rename MinRemaining AS "Runtime Remaining" |replace 3 WITH Utility, 4 WITH Bypass IN "Input Source" |sort "Runtime Remaining" |dedup "UPS Name" |table "UPS Name" "UPS Model" "Runtime Remaining" "Source" "Location" Note- The same spl query dont work when time range is last 20 days. Trouble shooting - Splunk receiving data till date however i have notice few thing, When i select last 30 days i can see the by fields in the search UPS Name , UPS Model , Runtime Remaining , Source When i select last 20 days the below fields are missing not sure why? Missing fields - UPS Name , UPS Model , Runtime Remaining , Source . So the below SPL query is not showing any data index=test 1sourcetype="stream" NOT upsModel=*1234* |rename Device AS "UPS " |rename Model AS "UPS Model" |rename MinRemaining AS "Runtime Remaining" |replace 3 WITH Utility, 4 WITH Bypass IN "Input Source" |sort "Runtime Remaining" |dedup "UPS Name" - |table "UPS Name" "UPS Model" "Runtime Remaining" "Source" "Location" The highlighted part not pulling any data due to missing field. Thanks
... View more