Dashboards & Visualizations

Backfill not working for a realtime dashboard

KarunK
Contributor

Hi All,

My realtime dashboard using Advanced xml (1hour window) is not doing the backfill.

The backfill in limits.conf is set to true

What else could prevent from dashboard doing the backfill ?

Thanks in Advance

Regards

KK

Update:

Hi All,

I am suspecting it be more of a sideviewutil problem? But not sure. The seraches seem to be very slow and the backfill wont work as soon as i introduce the pulldown module in sideviewutil.

Any thoughts ?

Thanks

KK

0 Karma
1 Solution

KarunK
Contributor

Identified as bug in Sideview/Splunk Core Engine. Sideview is taking up the issue with Splunk.

Workaround provided by sideview is as below. And It worked.

*If you want a hotfix, making sure you're on the latest Sideview utils, open /appserver/modules/SideviewUtils.js around line 1190, you'll see code that looks like this:

    abandonJob: function($super) {
        this.setPostProcess(false);
        return $super();
    }
change it to this: 

    abandonJob: function($super) {
        this.setPostProcess(false);
        this._statusBuckets = 0;
        this._requiredFieldList = [];
        return $super();
    }*

View solution in original post

sideview
SplunkTrust
SplunkTrust

There is no need to use that hotfix previously provided by Sideview.

Instead you can just update to latest Sideview Utils because the relevant bug in the core Splunk UI was patched by Sideview Utils back in Sideview Utils 2.4.8.

The Release Notes item for it is Patched the Splunk.Search class to clear "status buckets" and "required field list" properties instead of leaking them down to drilldown searches.

http://sideviewapps.com/apps/sideview-utils/release-notes/

Also there is a mailing list now for Sideview Utils, so you can more easily stay on top of Sideview Utils releases.

http://sideviewapps.com/apps/sideview-utils/mailing-list/

0 Karma

KarunK
Contributor

Identified as bug in Sideview/Splunk Core Engine. Sideview is taking up the issue with Splunk.

Workaround provided by sideview is as below. And It worked.

*If you want a hotfix, making sure you're on the latest Sideview utils, open /appserver/modules/SideviewUtils.js around line 1190, you'll see code that looks like this:

    abandonJob: function($super) {
        this.setPostProcess(false);
        return $super();
    }
change it to this: 

    abandonJob: function($super) {
        this.setPostProcess(false);
        this._statusBuckets = 0;
        this._requiredFieldList = [];
        return $super();
    }*

sideview
SplunkTrust
SplunkTrust

Actually I added an alternate answer because there's really no need to use that hotfix. The problem was addressed in Sideview Utils 2.4.8 so just update to the latest version (2.4.9) http://sideviewapps.com/apps/sideview-utils

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...