topic Re: IP Lookup Dashboard Panel in Dashboards & Visualizations

IP Lookup Dashboard Panel

antb — Mon, 11 May 2020 22:39:34 GMT

The below snip from my dashboard works fine when we run in the query in straight spl, however, when run via Dashboard Panel, I can see the proper query in the inspector but for some reason (I don't know why) it doesn't show any results.

Note: When I go down towards the inspector and select "open in search" I see the expected results.

Any ideas? I've tried opening up the permissions yet still nothing. I would provide more details but I can't think of anything else that matters.

Thank you in advance.

  <row>
    <panel>
      <title>IP Lookup</title>
      <input type="text" token="the_ip" searchWhenChanged="true">
        <label>IP</label>
      </input>
      <event>
        <title>IP Lookup</title>
        <search>
          <query>| inputlookup ip_list.csv where ip=$the_ip$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>

Re: IP Lookup Dashboard Panel

to4kawa — Mon, 11 May 2020 22:51:06 GMT

your input is not set <default>, so $the_ip$ token has no value.

Re: IP Lookup Dashboard Panel

antb — Mon, 11 May 2020 23:10:01 GMT

Hi, Thank you for the reply.

I've tried adding an example IP:
192.168.123.123

Into the input section above - still not helping. If I copy/paste the query out of the inspection drilldown, it shows output successfully.

Is it possible my problem is outside of the "Row" section above?

Re: IP Lookup Dashboard Panel

to4kawa — Mon, 11 May 2020 23:23:54 GMT

<query>| inputlookup ip_list.csv where ip="$the_ip$"</query>
eval need " with string.

Re: IP Lookup Dashboard Panel

antb — Tue, 12 May 2020 00:23:53 GMT

I figured it out. Very frustrating issue to experience.

https://answers.splunk.com/answers/228414/dashboard-issues-search-runs-in-search-window-not.html

Bottom line, change to stats instead of events view. The html above should be in a table section rather than an event wrapped section.