topic Re: Why does the saved search doesn't appear in the dashboard panel? in Dashboards & Visualizations

Why does the saved search doesn't appear in the dashboard panel?

zeespl — Mon, 17 Sep 2018 12:04:13 GMT

I have created a scheduled report and I am calling it in dashboard panel as base search.

I have applied some more filter to it and displayed in panel. But it says “ No results found”. Although when I click on "open in search" it works fine.
Even the saved results are fine.

Could you please advise what could be the issue?

Re: Why does the saved search doesn't appear in the dashboard panel?

vishaltaneja070 — Tue, 18 Sep 2018 11:26:37 GMT

Filters means, drill down, checkbox etc.

Re: Why does the saved search doesn't appear in the dashboard panel?

zeespl — Tue, 18 Sep 2018 11:41:50 GMT

No. Post process search. I am transforming the saved search result to display in dashboard panel.

Re: Why does the saved search doesn't appear in the dashboard panel?

renjith_nair — Tue, 18 Sep 2018 12:16:22 GMT

@zeespi,

Try mentioning the fields explicitly in the base search if you are using a post process search.

For e.g. base search |fields abc,xyz or even base search|fields * should do

In most of the similar cases, the post process search might be based on an extracted field and is not available in dashboard since dashboard by default runs the search in smart mode.

Reference : http://docs.splunk.com/Documentation/Splunk/latest/Search/Changethesearchmode

Re: Why does the saved search doesn't appear in the dashboard panel?

zeespl — Tue, 18 Sep 2018 13:41:50 GMT

Thanks Renjith. I already tried with table instead of fields and it worked.
Does this make any difference?

Re: Why does the saved search doesn't appear in the dashboard panel?

renjith_nair — Tue, 18 Sep 2018 14:07:21 GMT

They are almost same but you should not use the table command for charts (such as chart or timechart). Splunk Web requires the internal fields, which are the fields that begin with an underscore character, to render the charts. The table command strips these fields out of the results by default. To build charts, you should use the fields command instead. The fields command always retains all the internal fields.
http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Table

Re: Why does the saved search doesn't appear in the dashboard panel?

zeespl — Tue, 18 Sep 2018 14:29:02 GMT

Thanks renjith.