Splunk Search

Why does my search work in the Search App, but not as an inline search in a dashboard?

edrivera3
Builder

Hi

I have the following search that works correctly in the search app, but when I tried to include it as an inline search in the dashboard, it doesn't work.

index="job_event" | search error_number=05071 | eval "ACS Name"=acs_name | chart dedup_splitvals=t limit=100 useother=f count AS "# of Errors"  by "ACS Name" test_number format=$VAL$:::$AGG$ | sort limit=100 acs_name | fields - _span  | fields "ACS Name" *

I already checked that all extracted fields have permission to appear in all apps and users.
I also tried to change all quotation marks to & quot; but nothing changed.

Tags (3)
1 Solution

Flynt
Splunk Employee
Splunk Employee

You'll need to double escape the VAL and AGG as single $'s mean look for a token in a dashboard.

Try this

 index="job_event" | search error_number=05071 | eval "ACS Name"=acs_name | chart dedup_splitvals=t limit=100 useother=f count AS "# of Errors"  by "ACS Name" test_number format=$$VAL$$:::$$AGG$$ | sort limit=100 acs_name | fields - _span  | fields "ACS Name" *

In your dashboard.

View solution in original post

Flynt
Splunk Employee
Splunk Employee

You'll need to double escape the VAL and AGG as single $'s mean look for a token in a dashboard.

Try this

 index="job_event" | search error_number=05071 | eval "ACS Name"=acs_name | chart dedup_splitvals=t limit=100 useother=f count AS "# of Errors"  by "ACS Name" test_number format=$$VAL$$:::$$AGG$$ | sort limit=100 acs_name | fields - _span  | fields "ACS Name" *

In your dashboard.

edrivera3
Builder

It worked perfectly. Thank you.

0 Karma

krwinters11
Path Finder

I am also interested in an answer to this, as I have a similar question out that involves this issue and using the R Project app. http://answers.splunk.com/answers/229941/why-does-an-r-search-not-work-on-a-dashboard.html

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...