KB 98 (Splunk): CPU, Memory and Availability gauges displaying 0 values v 6.2.0 bug
Version: 1 from 23.03.2021
SYSTEM OVERVIEW QUERY FIX GUIDE
There are certain changes which need to be made in the queries of the top five panels of the System Overview dashboard which as shown in the below screenshot.
There are two possible ways to apply the fix which are listed below:
CHANGE QUERIES THROUGH SPLUNK UI
UPDATE DASHBOARD XML FILE (Recommended)
1. STEPS TO CHANGE QUERIES THROUGH SPLUNK UI:
Click on the Edit button present in the top left corner of the dashboard.
In the Edit mode, click on the search icon present on the top left corner of the panel.
Replace the current query by copying the updated query provided in the table.
Click on Apply after replacing the query.
Follow steps 2 to 4 for each of the five panels.
Select Save at the last to apply the changes to the dashboard.
Any custom changes in the dashboard from Splunk UI would create a copy of the same file in $SPLUNK_HOME/etc/apps/bnw-app-powerconnect/local/data/ui/views directory. This will prevent you from getting future updates of the app. Therefore, while updating the app to a newer version, remove this file from the local folder and then update the app.
Table: Query Changes to be made
2. STEPS TO UPDATE DASHBOARD XML FILE:
The updated XML code (sap_system_ovw.xml) of the dashboard provided can be added by following the steps given below:
Go to $SPLUNK_HOME/etc/apps/bnw-app-powerconnect/default/data/ui/views directory.
Copy and replace the xml file there.
Restart Splunk Enterprise to reflect the changes.
If you have made any custom changes in the dashboard from Splunk UI then there would be a copy of the same file in $SPLUNK_HOME/etc/apps/bnw-app-powerconnect/local/data/ui/views directory. So you will have to remove the copy from the local folder to view the updated dashboard. Make sure you take backup of the local copy in case you want to revert back to your custom changes later.