Dashboards & Visualizations

Why does my basic query work in search, but not in dashboard panel?

umdterps02
Path Finder

When I run this basic query in search, I get results:
alt text

When I run the same exact query in a dashboard panel, I get no results:

"Search did not return any events."

alt text

0 Karma
1 Solution

umdterps02
Path Finder

I figured out what the issue was, it appears that the CSV does not work with as an events table. I changed the table to a statistics table and it worked!

Thanks Everyone!

😃

View solution in original post

umdterps02
Path Finder

I figured out what the issue was, it appears that the CSV does not work with as an events table. I changed the table to a statistics table and it worked!

Thanks Everyone!

😃

briancronrath
Contributor

Are you running the search in the same app as the dashboard?

0 Karma

pruthvikrishnap
Contributor

Hi,
Instead of fields * try adding the fields to search, filed extraction may not happening in dashboard since it runs search in smart mode by default.

0 Karma

horsefez
SplunkTrust
SplunkTrust

@umdterps02,

try out

yoursearch | table *

You chose the event view, you need the table command to display fields

0 Karma

umdterps02
Path Finder

It works in search, but not panel. I still get no results, I will have to check with admin for permissions. =(

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Did you check the permissions of your lookup?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You can easily check if its a permissions issue now. Go to Settings > Lookups and find your lookup table and identify what app it belongs to. Then go to your dashboard and verify its in the same app

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...