Dashboard Event Totals Seem Wrong After Drilling into Report or Chart

Platform Deployment Guide › iConsole Standard Searches, Reports and Policies › Advanced Dashboard Configuration › Dashboard Event Totals Seem Wrong After Drilling into Report or Chart

Dashboard Event Totals Seem Wrong After Drilling into Report or Chart

In certain conditions, if a reviewer drills down into a report or dashboard chart, the number of results does not match the event total shown in the report or chart. This apparent disparity can occur if further events have been captured or reviewed in the intervening period since the snapshot totals were last calculated.

Snapshot totals are recalculated each time a data warehousing job runs. By default, these jobs run every hour. Consequently, snapshots (such as 'total unreviewed events') reflect the total number of events at the time when the job ran.

If the number of events (or incidents) in the CMS database rises or falls before the next data warehousing job runs (for example, because a manager reviews some previously unreviewed events), then the snapshot total shown in the report or dashboard will no longer tally with the actual number of underlying events in the CMS database. If a reviewer were to drill down into the report or dashboard at this point, they would see an apparent disparity in the number of events.

Example

Consider this timeline:

15:00 PM	A data warehousing jobs finds 100 unreviewed events and adds them to the data warehouse.
15:15 PM	A manager refreshes their dashboard. The snapshot total for Unreviewed Events is 100.
15:16 PM	The same manager drills down into the dashboard to see the underlying events. The Search Results screen does indeed find 100 unreviewed events.
15:30 PM	A reviewer audits 25 of the unreviewed events in the iConsole.
15:45 PM	The manager refreshes their dashboard; the snapshot total for Unreviewed Events is still 100. This is because there has been no new data warehousing job since 15.00 PM.
15:46 PM	The manager drills down into the dashboard again. But this time, the Search Results screen only finds 75 unreviewed events!
16:00 PM	The next data warehousing job runs and finds 75 unreviewed events. The snapshot total and number of underlying events are back in sync.

Note: Such potential disparities only affect snapshots of event counts based on audit status. They cannot occur with snapshots based on non-changing event attributes such as events counts by policy.