Dear all,
I have a dashboard table that does not display certain fields, which do have data - although not in every row - for the period searched.
The fields missing in the dashboard table are "group" and "rule".
when clicking the dashboard loop button - search in a new form - they do appear
Splunk version is 6.4.4.
the code is below:
<form>
<label>Cisco FW Change 02</label>
<search id="mc_unf_base">
<query>index=net_firewall sourcetype=cisco:asa vendor_class=config user="*" command="*"</query>
<earliest>$field_time.earliest$</earliest>
<latest>$field_time.latest$</latest>
</search>
<fieldset submitButton="false">
<input type="time" token="field_time">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<table>
<search base="mc_unf_base">
<query>| table _time, host, user, src, group, rule, severity_level, command, change_description
| rename host AS Firewall, user as User, src as "Client IP", severity_level as Severity</query>
</search>
<option name="wrap">false</option>
<option name="rowNumbers">true</option>
<option name="drilldown">row</option>
<option name="dataOverlayMode">none</option>
<option name="count">16</option>
</table>
</panel>
</row>
</form>
best regards
Altin
Whenever you use a base search, you need to explicitly specify all fields that you need for later searches. So change your base search to this:
index=net_firewall sourcetype=cisco:asa vendor_class=config user="*" command="*"| fields _time, host, user, src, group, rule, severity_level, command, change_description
Secondly, using a base search without a summarising command is not ideal.
Whenever you use a base search, you need to explicitly specify all fields that you need for later searches. So change your base search to this:
index=net_firewall sourcetype=cisco:asa vendor_class=config user="*" command="*"| fields _time, host, user, src, group, rule, severity_level, command, change_description
Secondly, using a base search without a summarising command is not ideal.
thank you very much @chrisyoungerjds
best regards
Altin
Are you seeing them when you run your search in search window? Also, if there are more than 10 results, they would appear in the next page. hope you have checked that in the table results.
index=net_firewall sourcetype=cisco:asa vendor_class=config user="" command="" |fillnull value="N/A" group, rule | stats count by group, rule
thank you,
but it is not a matter of pages. I do see them in search, but not in the statistical (dashboard) table