- Splunk Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Dashboard Panel Not Populating Unless Converted to...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am in the process of creating a dashboard with some inputs that get passed down to some panel tables. I am running into an issue where my dashboard panel is not populating a specific table column but, when I convert the panel to a report there is no issue. Is this a known issue or does anyone have an idea of what might be going on? I can include search syntax but since it works once it gets converted it clearly seems to work. Not a huge deal overall but more of an inconvenience.
Edit: My whole dashboard seems buggy. I can get results in my filters but, if I resave, even if nothing has changed, the multiselect I have breaks and no results are returned; even though I just had results. I am using a custom built function. Are there any known issues with using these in dashboards?
I did see a post that said _time might be an issue but that is not the case, I removed it and tested it with the same result.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @aohis,
Try explicitly mentioning the field in your dashboard for eg. fields field1,2,3, and try again. By default splunk runs in "smart mode" and field extraction might not be done implicitly. https://docs.splunk.com/Documentation/Splunk/7.1.1/Search/Changethesearchmode
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @aohis,
Try explicitly mentioning the field in your dashboard for eg. fields field1,2,3, and try again. By default splunk runs in "smart mode" and field extraction might not be done implicitly. https://docs.splunk.com/Documentation/Splunk/7.1.1/Search/Changethesearchmode
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When attempting this I am still getting the same results. Nothing populates for my field in the dashboard but, if I run it in search I am getting results.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
would you mind sharing the search used in dashboard? and also check the time range n both cases i.e. dashboard and search?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
"with POST CONDITIONS"
| search $host.name$
| rex field=_raw "Invoked:(?<Task>\w*).xml"
| rex field=_raw "Value:(?<HostTask>\w+-?\w+-?\w+\s?\w+?-?\w+\w+?-?\w+?\w+?\w+?\w+?)"
| table HostTask,Task,_time
Above is my search. $host.name$ name is coming from a multi select button. I have reviewed that multiple times and the syntax there works correctly; I even removed it and hard coded what gets fed into the search from the multi select, still HostTask does not populate.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
fields will bring the extracted field as well. So just try fields instead of table . And also make sure that you don't have any fields/table command in your base search which might have omitted the _raw
Introducing Splunk Enterprise 9.2
Adoption of RUM and APM at Splunk
Routing logs with Splunk OTel Collector for Kubernetes
