Splunk works in search but not in dashboard dropdown

super_edition — Mon, 07 Oct 2024 10:33:45 GMT

Hello Everyone,

My below splunk query works fine in normal splunk search and it returns expected results:

index="my_index" | stats count by kubernetes_cluster | table kubernetes_cluster | sort kubernetes_cluster

However when the same query when I have it in dashboard's dropdown it is not returning that data.

Search on Change is unchecked.

the dropdown looks like this:

source view:

<input type="dropdown" token="regions" searchWhenChanged="false"> <label>region</label> <fieldForLabel>regions</fieldForLabel> <fieldForValue>regions</fieldForValue> <search> <query>index="my_index" | stats count by kubernetes_cluster | table kubernetes_cluster | sort kubernetes_cluster</query> <earliest>0</earliest> <latest></latest> </search> </input>

Re: Splunk works in search but not in dashboard dropdown

gcusello — Mon, 07 Oct 2024 10:39:18 GMT

Hi @super_edition ,

the only field present in your search is "kubernetes_cluster" but the field in Label and value is "region".

use the same field.

Ciao.

Giuseppe

Re: Splunk works in search but not in dashboard dropdown

super_edition — Mon, 07 Oct 2024 12:01:53 GMT

Thanks. It worked

topic Re: Splunk works in search but not in dashboard dropdown in Dashboards & Visualizations

Splunk works in search but not in dashboard dropdown

Re: Splunk works in search but not in dashboard dropdown

Re: Splunk works in search but not in dashboard dropdown