topic Re: search index="name" shows 0 results, but index="name" does in Dashboards & Visualizations

search index="name" shows 0 results, but index="name" does

mcarlson — Fri, 03 Feb 2012 08:21:00 GMT

Hey Answers,

I created a new index called bacula.

When I search for:
"search index=bacula"

0 results show up. However, when I search for:
"index=bacula"

I get the data as expected.

The reason this matters is when I add my query to a dashboard, the dashboard automatically changes the query from "sourcetype=bacula..." to "search sourcetype=bacula..." and nothing shows up.

This is all within a app I created, and the index is associated with that app. I also modified the Roles (user and admin so far) to include the bacula index. Is there some addtional permission issues I have missed?

Thanks!

Mike

Re: search index="name" shows 0 results, but index="name" does

dwaddle — Fri, 03 Feb 2012 12:50:36 GMT

search is the search command to search, and should be implied but not included as part of the search. (For example, in subsearches you need to specify search as the command.) This behavior may be a bug. If you have enterprise support, I would suggest a support case.

Re: search index="name" shows 0 results, but index="name" does

atreece — Tue, 07 Feb 2012 18:33:03 GMT

Entering anything in the search field uses the search command. Executing a search with "search" in it (except when required for a subsearch) is asking splunk to look in that index for the word "search" in the data. If any of your events have the word "search" in them somewhere, they would show up in this case.

Re: search index="name" shows 0 results, but index="name" does

mcarlson — Tue, 07 Feb 2012 18:36:45 GMT

Right, and I am not including the word "search", Splunk is injecting "search" into the query when I add a saved search to a dashboard.

Re: search index="name" shows 0 results, but index="name" does

hexx — Tue, 07 Feb 2012 18:53:22 GMT

Where do you see the dashboard changing the query? Could you show us what lines appear in $SPLUNK_HOME/var/log/splunk/searches.log when you load the dashboard?