Hi all,
I'm getting a blue bar with "No matching fields exist" at the top of one of my dashboards. The funny thing is that all of the panels are populating.
I did rename the App by renaming the directory (I went through and changed the role's default app as well - and didn't have any private searches etc). So, I'm a bit paranoid that this may have caused the issue. I did restart Splunk afterwards.
Are there any log files I can check that might point out where the issue is?
Thanks!
To get rid of this, you need to have your dashboard in advanced XML mode. Add the following to the Message module:
<param name="level">warn</param>
The full Module section might look like this:
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
<param name="level">warn</param>
</module>
To get rid of this, you need to have your dashboard in advanced XML mode. Add the following to the Message module:
<param name="level">warn</param>
The full Module section might look like this:
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
<param name="level">warn</param>
</module>
Hi all,OK for starters, it turns out that my field extraction was not working under certain circumstances. That's fixed but I'm still getting the alert on a 12 hour timespan, whereas I don't on a 7 day one.After some investigation, it seems that the error is coming from me using the "table" command... when there are no results, it flags up.Is there a way of getting around this? ie: don't bother running the table command if there are no results? 🙂
Aha... removing one panel at a time has helped identify the culprit, although I have no idea why it's throwing up this error in the dashboard. Will post back with findings!