Dashboards & Visualizations

Why does the dashboard show no data, but opening the saved search or running it manually produces results?

jvishwak
Path Finder

I'm not able to see saved search data in a dashboard, but when I open the the same search and manually execute the search, it's giving proper results. When I open the saved search, then it also shows the results.

Permissions and all are looking fine.

Any suggestions why this could be happening?

Tags (2)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

It's possible that you have search time field extraction and in that case you have to specify the fields explicitly in the search since dashboards runs in fastmode.

Another possibility is to add "" to your field names. Sometimes strings have to be quoted for splunk to identify , especially in dashboard xmls

Happy Splunking!

phadnett_splunk
Splunk Employee
Splunk Employee

Are there any messages in the UI that might help us determine why? Does this happen consistently, even during different times of the day?

0 Karma

sundareshr
Legend

Check job inspector for clues.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...