Incomplete results in CMC Workload Dashboard after updating from Classic Dashboard to Dashboard Studio

Applicability

Description

After the CMC version was updated to new version i.e. from SimpleXML to Dashboard Studio, the workload dashboard is fetching incomplete results. 

After logging into CMC -->licensing-->workload, the dashboard is loading incomplete results.

Screenshot for reference.

Resolution

- This is a known issue tracked from January 2024.

- Workaround:
In the Peak SVC usage split by process panel, select Open in search and replace the search with the following to view the expected results.

So for this panel it becomes:

index=summary source="splunk-svc-consumer" svc_usage=*
| `sim_filter_stack(fnf)`
| fillnull value="" svc_consumer process_type search_provenances search_type search_app search_label search_user unified_sid search_modes labels search_head_names usage_source
| eval unified_sid=if(unified_sid="",usage_source,unified_sid)
| stats max(svc_usage) as utilized_svc by _time svc_consumer search_type search_app search_label search_user search_head_names unified_sid process_type
| timechart span=1h sum(utilized_svc) by svc_consumer
| rename "data services" as "ingestion", "search" as "search"

Related Links

SplunkCloud 9.1.2308 ReleaseNotes