KB 199 (Splunk): Application Servers Overview Error

Description

Reported in 8.1.0. In the Application Servers Overview dashboard in the Splunk App, the main panel will not display Total Request Time data. This issue has likely been present since the dashboard was added in Splunk App version 7.0.0.

Cause

A mistype in the query prevents it from joining data from the SM51_QUEUE event type.

Resolution

A Splunk Admin or user with edit privileges will need to modify the dashboard.

1. Open the Application Servers Overview dashboard.

2. Click on the top right of the page.

3. Click the icon to edit the main panel.

4. Replace search line 13 with corrected SPL. Before and After are shown below.
   Before:

   | stats sum(REQ_WAIT) as "Total Request Time", values(INSTANCE_NAME) as "NAME"

   After:

   | stats sum(REQ_WAIT) as "Total Request Time" by INSTANCE_NAME | rename INSTANCE_NAME as NAME

5. Click after the change has been made.

6. Click at the top right of the page.