The Saved Question That Shows 12% Under a 10% Filter
A saved question Low Disk Space has columns Computer Name, Operating System, Disk Free Percent, and Last Reboot, and a filter Disk Free Percent is less than 10. It is used on a dashboard against All Computers. A service owner manually runs the same four columns against the same group and sees 412 rows; the dashboard shows 268. The dashboard was last refreshed 6 hours ago. The Disk Free Percent sensor has a 4-hour cache. Several dashboard rows show 12%.
1. What are the plausible reasons for 268 vs 412, and what check distinguishes each?
Read the worked answer
First, staleness: the dashboard is a 6-hour-old snapshot, so endpoints that crossed the 10% line since then are missing. Second, cache: the sensor returns a value up to 4 hours old unless refreshed; a manual run may hit a different cache age than the dashboard snapshot. Third, scope: verify the dashboard widget and the manual question are using the same computer group and the same saved-question revision; a persona-scoped dashboard can silently use a subgroup. Fourth, filter/column mismatch: rows showing 12% mean the filter is not being evaluated against the same value being displayed. That happens when the filter references a different sensor, alias, or revision than the column. Check the saved-question definition, the dashboard widget configuration, the run history, and a sample endpoint's sensor output.
2. Why can a row show 12% when the filter says less than 10?
Read the worked answer
A filter is evaluated on the endpoint as part of the question, but only if it names the same sensor and value that the column displays. If the filter uses an older sensor version, a different alias, or a cached value while the column uses a fresh value, an endpoint can pass on one number and display another. The dashboard may also have been built from an earlier saved-question revision that lacked the filter. The 12% rows are the diagnostic clue: do not treat them as cosmetic; reconcile filter sensor, column sensor, cache setting, and saved-question revision.
3. How would you make this reliable for dashboard and ad hoc use?
Read the worked answer
Use one sensor for both filter and column and document the cache. If current state matters, force a fresh evaluation or shorten cache, and set dashboard refresh to a cadence that matches the cache. Pin the dashboard to a reviewed saved-question revision and verify its computer group. Add Last Seen so stale endpoints are visible rather than silently included. For trend reporting, use a separate scheduled question or reporting data set; do not ask a 4-hour-cache sensor to answer a real-time dashboard question. Validate by running the saved question and the dashboard against a 100-endpoint control group.