topic Re: Dashboard Statistics Table Not Showing in Knowledge Management

Dashboard Statistics Table Not Showing

daniel_augustyn — Fri, 08 Apr 2016 20:17:10 GMT

I am building a dashboard and I've been having an issue with presenting Statistics Tables on the dashboard while logged in as another user. I wanted to set it up on the big screens in the SOC using another user account. After I created all dashboards, they are all showing fine, except for the Statistics Table ones. Any idea why I can't show Statistics Tables dashboard to other users via dashboards. I can see it fine on my screen, but on the big screens it shows "No results found".

Re: Dashboard Statistics Table Not Showing

somesoni2 — Fri, 08 Apr 2016 21:00:06 GMT

Does the user using which you're running the dashboard has access to the the data (index specifically) on which the table is built?

Re: Dashboard Statistics Table Not Showing

twinspop — Fri, 08 Apr 2016 21:26:52 GMT

And also the permissions on knowledge objects, like fields, lookups, etc. If you, for example, do a stats count by private_field, you will get a no results message

Re: Dashboard Statistics Table Not Showing

daniel_augustyn — Fri, 08 Apr 2016 21:55:27 GMT

yes, when you present the same dashboard as Lines, Bars, etc, it shows up. The Statistics Table options doesn't want to show the data. It still shows "no results found".

Re: Dashboard Statistics Table Not Showing

daniel_augustyn — Fri, 08 Apr 2016 21:58:33 GMT

The same dashboards are showing as Bars, Lines, Areas, but not Tables.

Re: Dashboard Statistics Table Not Showing

woodcock — Sat, 09 Apr 2016 17:15:27 GMT

SHOW US YOUR SEARCH (yes, it makes a difference)!

There are MANY reasons for such a thing but the one that is the most common and frustrating is when searches do not contain an explicit index= ... portion and relies instead on the user's (role's) Indexes searched by default setting. Add an explicit index=... expression and see if that works.

Re: Dashboard Statistics Table Not Showing

daniel_augustyn — Tue, 29 Sep 2020 09:35:02 GMT

index=proxy category=Malicious* | stats count by src, action, cs_method, dest_host, category | sort limit=10 -count

Re: Dashboard Statistics Table Not Showing

daniel_augustyn — Thu, 28 Apr 2016 23:12:26 GMT

There is something wrong with this. It doesn't work again.

Re: Dashboard Statistics Table Not Showing

woodcock — Fri, 29 Apr 2016 14:05:17 GMT

If this is your search:

index=proxy category=Malicious* | stats count by src, action, cs_method, dest_host, category | sort limit=10 -count

Then the problem is the limit=10 which is the wrong syntax. Try this:

index=proxy category=Malicious* | stats count by src, action, cs_method, dest_host, category | sort 10 -count

Re: Dashboard Statistics Table Not Showing

daniel_augustyn — Mon, 02 May 2016 17:48:14 GMT

Not sure why this was a wrong syntax, when with the logged in user who created this dashboard, it was showing just fine. It's didn't fix the issue by removing 'limit='.

Re: Dashboard Statistics Table Not Showing

daniel_augustyn — Mon, 02 May 2016 17:51:34 GMT

It's so weird, the events are showing under Events tab but Splunk can't generate dashboard from these events. It only works with the user which created this dashboard. I can share it because it doesn't show under other users.

Re: Dashboard Statistics Table Not Showing

woodcock — Tue, 03 May 2016 14:32:40 GMT

It is likely a permissions problem somewhere. Either the other users do not have permission to access the index, or do not have access to a macro that is used in the search or something like that. Strip off consecutive pipes from the right side until the search works and then see why the other user does not have access to the thing that you just removed.

Re: Dashboard Statistics Table Not Showing

daniel_augustyn — Tue, 03 May 2016 17:05:38 GMT

I put both users in the same roles: power, admin, and user and this didn't help. Where else should I be looking at the permissions?

Re: Dashboard Statistics Table Not Showing

daniel_augustyn — Tue, 29 Sep 2020 09:35:47 GMT

This query works just fine: index=proxy category=Malicious* | table src, action, cs_method, dest_host, category
but this one doesn't: index=proxy category=Malicious* | stats count by src, action, cs_method, dest_host, category

Re: Dashboard Statistics Table Not Showing

woodcock — Wed, 04 May 2016 05:33:09 GMT

OK, then you should figure out what field extraction or app creates the src, action, cs_method, dest_host, and category fields. Then make sure both users have permission to those. If any field in the by clause is missing/null, then the entire command will fail (drop all events).

Re: Dashboard Statistics Table Not Showing

daniel_augustyn — Wed, 04 May 2016 23:53:35 GMT

And this totally fixed the issue!! Thanks a lot, some of the regex didn't have global permission to be read by other users.