Hi
I have the following search that works correctly in the search app, but when I tried to include it as an inline search in the dashboard, it doesn't work.
index="job_event" | search error_number=05071 | eval "ACS Name"=acs_name | chart dedup_splitvals=t limit=100 useother=f count AS "# of Errors" by "ACS Name" test_number format=$VAL$:::$AGG$ | sort limit=100 acs_name | fields - _span | fields "ACS Name" *
I already checked that all extracted fields have permission to appear in all apps and users.
I also tried to change all quotation marks to & quot; but nothing changed.
You'll need to double escape the VAL and AGG as single $'s mean look for a token in a dashboard.
Try this
index="job_event" | search error_number=05071 | eval "ACS Name"=acs_name | chart dedup_splitvals=t limit=100 useother=f count AS "# of Errors" by "ACS Name" test_number format=$$VAL$$:::$$AGG$$ | sort limit=100 acs_name | fields - _span | fields "ACS Name" *
In your dashboard.
You'll need to double escape the VAL and AGG as single $'s mean look for a token in a dashboard.
Try this
index="job_event" | search error_number=05071 | eval "ACS Name"=acs_name | chart dedup_splitvals=t limit=100 useother=f count AS "# of Errors" by "ACS Name" test_number format=$$VAL$$:::$$AGG$$ | sort limit=100 acs_name | fields - _span | fields "ACS Name" *
In your dashboard.
It worked perfectly. Thank you.
I am also interested in an answer to this, as I have a similar question out that involves this issue and using the R Project app. http://answers.splunk.com/answers/229941/why-does-an-r-search-not-work-on-a-dashboard.html