I have a Simple XML dashboard which does
<form>
<label>Admin Dashboard</label>
<description/>
<fieldset>
<input type="dropdown" token="company" searchWhenChanged="true">
<label>Select a Company:</label>
<default>*</default>
<choice value="*">All Companies</choice>
<populatingSearch fieldForValue="Company" fieldForLabel="Co_Name">
<![CDATA[ | inputlookup rich-co ]]>
</populatingSearch>
</input>
<input type="time" searchWhenChanged="true">
<label>Select a time</label>
<default>
<earliestTime>-7d@w0</earliestTime>
<latestTime>@w0</latestTime>
</default>
</input>
</fieldset>
<row>
<single>
<searchString>sourcetype=completions_standard Company=$company$ | eval f=if("$company$"=="*","All Companies",Co_Name) | table f</searchString>
<earliestTime>$earliest$</earliestTime>
<latestTime>$latest$</latestTime>
</single>
</row>
<row>
<chart>
<title>Last week's visitors to the Knowledge Centre</title>
<searchString>sourcetype="logins_*" Company=$company$ | timechart dc(Username)</searchString>
<earliestTime>$earliest$</earliestTime>
<latestTime>$latest$</latestTime>
<option name="charting.chart">area</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.placement">none</option>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="charting.axisTitleY.text">Users</option>
<option name="charting.axisLabelsY.majorUnit">10</option>
<option name="charting.axisTitleX.text">Date</option>
</chart>
</row>
</form>
When I open the dashboard, both panels have the text
Search query is not fully resolved
Any idea what's wrong?
In Splunk known issues: "eval $foo$ tokens don't work in Simple XML, searches fail with error Search query is not fully resolved. (SPL-74498)"
Looks like it has to do with this?
eval f=if("$company$"=="*","All Companies",Co_Name)
You can't have more than one answer. just glad things working for you.
Not sure if you can have more than one answer, but if you can, please add your post as an answer and I will accept it.
Ah, I just flagged cschmidt0121's reply as the answer, but now I changed the autorun to autoRun (capital R) and it works. It doesn't seem to matter about the case of true, both upper and lower case t works.
Sorry, I overlooked the case.
Try changing
I tried the exact same xml of yours and its working fine (its showing no result found as I don't have data, but no error)
In Splunk known issues: "eval $foo$ tokens don't work in Simple XML, searches fail with error Search query is not fully resolved. (SPL-74498)"
Looks like it has to do with this?
eval f=if("$company$"=="*","All Companies",Co_Name)
Yes, you're right. I removed the first panel and it still had the problem, so I changed Company=$company$ in the second panel and it fixes the problem. Thanks for that. Not a big deal, just messy.
No difference.
Try changing