I'm trying to display a chart using FlashChart. When I run the raw query, it works perfectly and displays the chart as I expected. But when I try to render it to a FlashTable I get this error: "400 - Error in lookup command: Could not find all the specified destination fields in lookup table." Also, when I try to render the results to a SimpleResultsTable, I get this error: "The job appears to have expired or has been canceled. Splunk could not retrieve data for this search." which seems like it's just indicating that the search failed.
Here's my XML:
<view autoCancelInterval="90" isVisible="true" onunloadCancelJobs="true" template="dashboard.html">
<label>Alarms</label>
<module name="SideviewUtils" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="TextField" layoutPanel="panel_row1_col1_grp1">
<param name="label">Channel:</param>
<param name="name">channel</param>
<module name="Search" >
<param name="search">
sourcetype="telemetry" chan_name="$channel.value$" | lookup alarm_lookup chan_name OUTPUT red_type, yellow_type, high_red, low_red, high_yellow, low_yellow | eval value=if(eu!="", eu, dn) | eval HIGH_RED=high_red |eval LOW_RED=low_red | eval HIGH_YELLOW=high_yellow | eval LOW_YELLOW=low_yellow | chart first(value) AS Value, first(HIGH_RED) AS HIGH_RED, first(LOW_RED) AS LOW_RED, first(HIGH_YELLOW) AS HIGH_YELLOW, first(LOW_YELLOW) AS LOW_YELLOW by scet
</param>
<module name="HTML">
<param name="html">$search$</param>
</module>
<module name="SimpleResultsTable">
<param name="entityName">results</param>
</module>
<module name="HiddenChartFormatter">
<param name="chart">line</param>
<param name="chartTitle">Channel Values and Alarm Thresholds</param>
<param name="secondaryAxisTitle.text">Value</param>
<param name="legend.placement">right</param>
<module name="JobProgressIndicator"/>
<module name="FlashChart" />
</module>
</module>
</module>
</view>
... View more