topic No matching fields exist in Dashboards & Visualizations

No matching fields exist

Narj — Mon, 06 Aug 2012 12:17:56 GMT

Hi all,

I'm getting a blue bar with "No matching fields exist" at the top of one of my dashboards. The funny thing is that all of the panels are populating.

I did rename the App by renaming the directory (I went through and changed the role's default app as well - and didn't have any private searches etc). So, I'm a bit paranoid that this may have caused the issue. I did restart Splunk afterwards.

Are there any log files I can check that might point out where the issue is?

Thanks!

Re: No matching fields exist

Narj — Mon, 06 Aug 2012 12:34:00 GMT

Aha... removing one panel at a time has helped identify the culprit, although I have no idea why it's throwing up this error in the dashboard. Will post back with findings!

Re: No matching fields exist

Narj — Mon, 06 Aug 2012 13:12:54 GMT

Hi all,OK for starters, it turns out that my field extraction was not working under certain circumstances. That's fixed but I'm still getting the alert on a 12 hour timespan, whereas I don't on a 7 day one.After some investigation, it seems that the error is coming from me using the "table" command... when there are no results, it flags up.Is there a way of getting around this? ie: don't bother running the table command if there are no results? 🙂

Re: No matching fields exist

helge — Sat, 01 Dec 2012 23:00:20 GMT

To get rid of this, you need to have your dashboard in advanced XML mode. Add the following to the Message module:

<param name="level">warn</param>

The full Module section might look like this:

<module name="Message" layoutPanel="messaging">
   <param name="filter">*</param>
   <param name="clearOnJobDispatch">False</param>
   <param name="maxSize">1</param>
   <param name="level">warn</param>
</module>