Dashboards & Visualizations

IP Lookup Dashboard Panel

antb
Path Finder

The below snip from my dashboard works fine when we run in the query in straight spl, however, when run via Dashboard Panel, I can see the proper query in the inspector but for some reason (I don't know why) it doesn't show any results.

Note: When I go down towards the inspector and select "open in search" I see the expected results.

Any ideas? I've tried opening up the permissions yet still nothing. I would provide more details but I can't think of anything else that matters.

Thank you in advance.

  <row>
    <panel>
      <title>IP Lookup</title>
      <input type="text" token="the_ip" searchWhenChanged="true">
        <label>IP</label>
      </input>
      <event>
        <title>IP Lookup</title>
        <search>
          <query>| inputlookup ip_list.csv where ip=$the_ip$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
0 Karma
1 Solution

antb
Path Finder

I figured it out. Very frustrating issue to experience.

https://answers.splunk.com/answers/228414/dashboard-issues-search-runs-in-search-window-not.html

Bottom line, change to stats instead of events view. The html above should be in a table section rather than an event wrapped section.

View solution in original post

0 Karma

antb
Path Finder

I figured it out. Very frustrating issue to experience.

https://answers.splunk.com/answers/228414/dashboard-issues-search-runs-in-search-window-not.html

Bottom line, change to stats instead of events view. The html above should be in a table section rather than an event wrapped section.

0 Karma

to4kawa
Ultra Champion

your input is not set <default>, so $the_ip$ token has no value.

0 Karma

antb
Path Finder

Hi, Thank you for the reply.

I've tried adding an example IP:
192.168.123.123

Into the input section above - still not helping. If I copy/paste the query out of the inspection drilldown, it shows output successfully.

Is it possible my problem is outside of the "Row" section above?

0 Karma

to4kawa
Ultra Champion

<query>| inputlookup ip_list.csv where ip="$the_ip$"</query>
eval need " with string.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...