Dashboards & Visualizations

makeresult Work in normal Search app but not in my Dashboard

mklhs
Path Finder

Hello,

i want to build a dashboard with different panels to Analyse some Alarms.
At the Top i have 2 Input fields field1(text input) and field2(dropdown for status)
I want to habe a panel or an hidden query where i build with | makeresult some Values and write them into my index. Like an Kommentary Funktion for Analysis.
My Problem is now that if i use this query in normal Search app:

| makeresults
| eval event_hash=123
| eval kommentar=abc
| eval wann = now()
| table event_hast kommentar wann

it works perfectly....

But if im going to Save this as a dashboard Panel and look at my Dashboard, it say that no Results get Reflected.

Anyone know This issue?

Thanks for your Help

0 Karma

woodcock
Esteemed Legend

As I suspected, you saved it with the Events visualization instead of the Statistics. Change this:

<event>
...
</event>

To this:

<table>
...
</table>

mklhs
Path Finder

Thank you for your Time
This is the Part from my Dashboard, if you need more Tell me
My Dashboard:

<form>
  <label>Analyse Dashboard</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="text" token="analyse_result" searchWhenChanged="true">
      <label>Analyse Ergebnis</label>
    </input>
    <input type="dropdown" token="alarm_status">
      <label>Alarm Status ändern</label>
      <choice value="Open">Offen</choice>
      <choice value="Work">In Arbeit</choice>
      <choice value="Closed">Geschlossen</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <search>
          <query>| makeresults 
| eval event_hash=123 
| eval alarm_phase = "Open" 
| eval wann = now() 
| eval kommentar="bla" 
| table event_hash alarm_phase wann kommentar</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="list.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </event>
    </panel>
  </row>
</form>
0 Karma

woodcock
Esteemed Legend

Post your dashboard XML so we can all play.

0 Karma

mklhs
Path Finder

Thank you for your Time
This is the Part from my Dashboard, if you need more Tell me
My Dashboard:

Analyse Dashboard

 <input type="text" token="analyse_result" searchWhenChanged="true">
      <label>Analyse Ergebnis</label>
    </input>
    <input type="dropdown" token="alarm_status">
      <label>Alarm Status ändern</label>
      <choice value="Open">Offen</choice>
      <choice value="Work">In Arbeit</choice>
      <choice value="Closed">Geschlossen</choice>
    </input>


    <panel>
      <event>
        <search>
          <query>| makeresults 
| eval event_hash=123 
| eval alarm_phase = "Open" 
| eval wann = now() 
| eval kommentar="bla" 
| table event_hash alarm_phase wann kommentar
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="list.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </event>
    </panel>
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...