"No results found "when I run a search on the dashboard

[modernjameschen]

I create a dashboard to monitor the device
Using the network toolkit application
Set in Data inputs> ping
Run every 30 seconds
search field with Visualization
Below is my dashboard code

<dashboard>
   <label>Monitor Device</label>
   <row>
     <panel>
       <title>192.168.x.x</title>
       <single>
         <search>
           <query>index = main "dest=192.168.x.x" | chart avg(packet_loss)</query>
           <earliest>-30s</earliest>
           <latest>now</latest>
           <sampleRatio>1</sampleRatio>
           <refresh>15s</refresh>
           <refreshType>delay</refreshType>
         </search>
         <option name="colorBy">value</option>
         <option name="colorMode">block</option>
         <option name="drilldown">none</option>
         <option name="numberPrecision">0</option>
         <option name="rangeColors">["0x53a051","0xf8be34","0xf1813f","0xdc4e41","0xdc4e41"]</option>
         <option name="rangeValues">[26,51,76,100]</option>
         <option name="showSparkline">1</option>
         <option name="showTrendIndicator">1</option>
         <option name="trellis.enabled">0</option>
         <option name="trellis.scales.shared">1</option>
         <option name="trellis.size">medium</option>
         <option name="trendColorInterpretation">standard</option>
         <option name="trendDisplayMode">absolute</option>
         <option name="unitPosition">after</option>
         <option name="useColors">1</option>
         <option name="useThousandSeparators">1</option>
       </single>
     </panel>
   </row>
 ...
 </dashboard>

No results found after a few minutes

This is very confusing to me
Who can help me
Thanks a lot

Incidentally ,I monitor about 70 devices
Use splunk enterprise version:8.0.1
network toolkit version:1.4.3
Operating system : Ubuntu 18.0.4
I am changing parameters in SPLUNK_HOME /etc/system/local/limits.conf

# The base number of concurrent searches.
base_max_searches = 30

# Max real-time searches = max_rt_search_multiplier x max historical searches.
max_rt_search_multiplier = 30

# The maximum number of concurrent searches per CPU.
max_searches_per_cpu = 30

[gcusello]

Hi @modernjameschen,
you have to debug your search opening it in Search Dashboard.
The approach is to delete a slice of your search from the end to the last pipe and watching results, if you have something, analyze them, if you haven't delete another slice of search until the previous pipe.

At first sight, I think that you should try to enlarge the time period because 30 seconds are very few and you couldn't have events.
then check the string "dest=192.168.x.x", because it's used by Splunk as a string and not as a field (it's between brackets!) and try using star instead x.
At least, see in the search results if the packet_loss field (that you use in the chart command) is present in your results, if not this is the problem.

Ciao.
Giuseppe

[to4kawa]

 <query>index = main "dest=192.168.x.x" | chart avg(packet_loss)</query>

⇨

 <query>index = main dest=192.168.0.0/16 | chart avg(packet_loss)</query>