I am attempting to use a base search on my dashboard, but I cannot get the chart to appear. Here is what the XML of the dashboard looks like:
<dashboard>
<search id="Prod1ValidateClaimLast30Min">
<query> index=ssi_app_index TATL message.facets.url=*ValidateClaim* message.facets.url=https://me.myself.com*</query>
<earliest>rt-30m</earliest>
<latest>rt</latest>
</search>
<label>SAP Test</label>
<row>
<panel>
<chart>
<title>Product Median ValidateClaim Last 30 Min, sec</title>
<search base="Prod1ValidateClaimLast30Min">
<query>stats median(message.facets.duration) as ValidationAvg | eval ValidationAvg=round(ValidationAvg/1000,2)</query>
</search>
</chart>
</panel>
</row>
</dashboard>
If I click on the "Open in Search" button from the dashboard then data shows up and the search is concatenated correctly.
Hi SAPrabhakar,
I don't know why Splunk has this behavior that I found many times, maybe it's a Splunk bug and I opened a case to Support some months ago.
Every way, you can use a workaround (or better a "porkaround"!) inserting in your base search an eval command with fields you have to use in the panel's search, in your example:
index=ssi_app_index TATL message.facets.url=*ValidateClaim* message.facets.url=https://me.myself.com* | eval message.facets.duration=message.facets.duration
If you have more fields you have to add each one in the same way.
Bye.
Giuseppe
Hi
Your xml code syntax is correct just verify if your search code works well.
Verify if the following search code works :
index=ssi_app_index TATL message.facets.url="*ValidateClaim*" message.facets.url="https://me.myself.com*"|stats median(message.facets.duration) as ValidationAvg | eval ValidationAvg=round(ValidationAvg/1000,2)
Try adding all the field values in double quotes and also add the field to be used later in second query.
index="ssi_app_index" TATL message.facets.url="ValidateClaim" message.facets.url="https://me.myself.com*"| *table message.facets.duration | fields **
Having said that your query should have worked as well, so try joining base and second stats query together and see if you are getting any results back or not.
There are a couple of things I think you should consider with what you are doing here.