https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-for-OSSEC-Dashboard-No-results-found/m-p/243289#M15111 <P>They were just gone apparently, I added them again and now its working <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 14 Oct 2016 11:49:08 GMT nickbijmoer 2016-10-14T11:49:08Z https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-for-OSSEC-Dashboard-No-results-found/m-p/243285#M15107 <P>Hello guys,</P> <P>A few days ago the default dashboard of OSSEC in splunk worked fine, but I had to clean up some space so I deleted some data logs and now when I open the default dashboard it says: No results found. <BR /> So I dont know why, but I dont get data anymore and I tought I didnt change anything...<BR /> Can some1 help me? If you have questions please ask <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 12 Oct 2016 11:05:24 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-for-OSSEC-Dashboard-No-results-found/m-p/243285#M15107 nickbijmoer 2016-10-12T11:05:24Z https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-for-OSSEC-Dashboard-No-results-found/m-p/243286#M15108 <P>Have you checked the underlying query generating the dashboards to see if a field was renamed or now has no data/results?</P> Wed, 12 Oct 2016 14:52:16 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-for-OSSEC-Dashboard-No-results-found/m-p/243286#M15108 DEAD_BEEF 2016-10-12T14:52:16Z https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-for-OSSEC-Dashboard-No-results-found/m-p/243287#M15109 <P>Yeah I checked it, It gives no data if I search with that query, but the data that he used before is still in SPLUNK so I might have a field that renamed indeed or something like that... Is there an option to set all fields to default again or reset all fields?</P> Thu, 13 Oct 2016 07:26:14 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-for-OSSEC-Dashboard-No-results-found/m-p/243287#M15109 nickbijmoer 2016-10-13T07:26:14Z https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-for-OSSEC-Dashboard-No-results-found/m-p/243288#M15110 <P>I'm not sure if there's an option to set all fields to default again. I honestly think the easiest thing will be to just manually check each field. They are case-sensitive, so I'd be sure to check them very carefully! Sounds like a field prob. got renamed so the query isn't working. Let me know how this comes along.</P> Thu, 13 Oct 2016 15:21:21 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-for-OSSEC-Dashboard-No-results-found/m-p/243288#M15110 DEAD_BEEF 2016-10-13T15:21:21Z https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-for-OSSEC-Dashboard-No-results-found/m-p/243289#M15111 <P>They were just gone apparently, I added them again and now its working <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 14 Oct 2016 11:49:08 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-for-OSSEC-Dashboard-No-results-found/m-p/243289#M15111 nickbijmoer 2016-10-14T11:49:08Z https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-for-OSSEC-Dashboard-No-results-found/m-p/243290#M15112 <P>Some of the fields themselves were gone? As in, no logs contained data for such a named field? That is really odd. How did you add it again to fix it? Just so others know as well in the future <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 14 Oct 2016 14:42:25 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-for-OSSEC-Dashboard-No-results-found/m-p/243290#M15112 DEAD_BEEF 2016-10-14T14:42:25Z https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-for-OSSEC-Dashboard-No-results-found/m-p/243291#M15113 <P>Yeah I just manually extracted the fields again <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 17 Oct 2016 06:58:13 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Splunk-for-OSSEC-Dashboard-No-results-found/m-p/243291#M15113 nickbijmoer 2016-10-17T06:58:13Z