topic Re: search not working in dashboard in Dashboards & Visualizations https://community.splunk.com/t5/Dashboards-Visualizations/search-not-working-in-dashboard/m-p/116286#M6696 <P>Hi,</P> <P>Hope this pastes ok as I cant attach a file (karma points)</P> <P>SANS 20 OVERVIEW</P> <PRE><CODE>&lt;panel&gt; &lt;title&gt;SANS 1&lt;/title&gt; &lt;single&gt; &lt;title&gt;Authorized &amp;amp; Unauthorized Devices&lt;/title&gt; &lt;search&gt; </CODE></PRE> <P>| dbquery "database" "SELECT * FROM new_compliancelist"| stats count(eval(FAILED&lt;1)) as success count as total | eval value = success/total*100 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> <BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> <BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_1" target="_blank">Additional Information</A> <BR /> <BR /> <PANEL><BR /> <TITLE>SANS 2</TITLE><BR /> <SINGLE><BR /> <TITLE>Authorized &amp; Unauthorized Software</TITLE><BR /> <SEARCH><BR /> <QUERY>| stats count as value | eval value = 0 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none</QUERY><BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_2" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 3</TITLE><BR /> <SINGLE><BR /> <TITLE>Secure Configurations for Hardware &amp; Software</TITLE><BR /> <SEARCH><BR /> | dbquery "database" "SELECT * FROM new_compliancelist"| stats count(eval(FAILED&lt;1)) as success count as total| eval SANS31 = success/total*100 |fields SANS31 | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.2" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.2] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.3" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.3] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.6" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.6] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.7" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.7] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.10" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.10] | eval SANS3=('SANS31'+'SANS3.2'+'SANS3.3'+'SANS3.10'+'SANS3.7'+'SANS3.6')/6 | rangemap field=SANS3 elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_3" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 4</TITLE><BR /> <SINGLE><BR /> <TITLE>Continuous Vulnerability Assesment</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 95 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_4" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 5</TITLE><BR /> <SINGLE><BR /> <TITLE>Malware and Anti virus Defenses</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 95 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_5" target="_blank">Additional Information</A> <BR /> </PANEL></P> <PRE><CODE>&lt;panel&gt; &lt;title&gt;SANS 6&lt;/title&gt; &lt;single&gt; &lt;title&gt;Application Software&lt;/title&gt; &lt;search&gt; </CODE></PRE> <P>| stats count as value | eval value = 20 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> <BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> <BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_6" target="_blank">Additional Information</A> <BR /> <BR /> <PANEL><BR /> <TITLE>SANS 7</TITLE><BR /> <SINGLE><BR /> <TITLE>Wireless Access Control</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 25 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_7" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 8</TITLE><BR /> <SINGLE><BR /> <TITLE>Data Recovery Capability</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 25 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_8" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 9</TITLE><BR /> <SINGLE><BR /> <TITLE>Secure Skills Assesment</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 10 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_9" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 10</TITLE><BR /> <SINGLE><BR /> <TITLE>Secure Configurations</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 10 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_10" target="_blank">Additional Information</A> <BR /> </PANEL></P> <PRE><CODE>&lt;panel&gt; &lt;title&gt;SANS 11&lt;/title&gt; &lt;single&gt; &lt;title&gt;Limitation &amp;amp; Control of Network Ports, Protocols&lt;/title&gt; &lt;search&gt; </CODE></PRE> <P>| stats count as value | eval value = 25 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> <BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> <BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_11" target="_blank">Additional Information</A> <BR /> <BR /> <PANEL><BR /> <TITLE>SANS 12</TITLE><BR /> <SINGLE><BR /> <TITLE>Controlled use of Administrative Privileges</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 60 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans12_" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 13</TITLE><BR /> <SINGLE><BR /> <TITLE>Boundary Defense</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 70 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_13" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 14</TITLE><BR /> <SINGLE><BR /> <TITLE>Monitoring of Logs</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 20 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_14" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 15</TITLE><BR /> <SINGLE><BR /> <TITLE>Controlled Access based on Need to Know</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 20 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_15" target="_blank">Additional Information</A> <BR /> </PANEL></P> <PRE><CODE>&lt;panel&gt; &lt;title&gt;SANS 16&lt;/title&gt; &lt;single&gt; &lt;title&gt;Account Monitoring &amp;amp; Control&lt;/title&gt; &lt;search&gt; </CODE></PRE> <P>| stats count as value | eval value = 25 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> <BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> <BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_16" target="_blank">Additional Information</A> <BR /> <BR /> <PANEL><BR /> <TITLE>SANS 17</TITLE><BR /> <SINGLE><BR /> <TITLE>Data Protection</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 30 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_17" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 18</TITLE><BR /> <SINGLE><BR /> <TITLE>Incident Response &amp; Management</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 25 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_18" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 19</TITLE><BR /> <SINGLE><BR /> <TITLE>Secure Network Engineering</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 14 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_19" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 20</TITLE><BR /> <SINGLE><BR /> <TITLE>Penetration Tests</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 95 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_20" target="_blank">Additional Information</A> <BR /> </PANEL></P> Mon, 28 Sep 2020 20:00:29 GMT crossap 2020-09-28T20:00:29Z search not working in dashboard https://community.splunk.com/t5/Dashboards-Visualizations/search-not-working-in-dashboard/m-p/116283#M6693 <P>Hi,</P> <P>newly created search will not work as part of dashboard</P> <P>| dbquery "database" "SELECT * FROM new_compliancelist"| stats count(eval(FAILED&lt;1)) as success count as total| eval SANS31 = success/total*100 |fields SANS31 | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.2" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.2] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.3" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.3] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.6" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.6] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.7" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.7] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.10" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.10] | eval SANS3=('SANS31'+'SANS3.2'+'SANS3.3'+'SANS3.10'+'SANS3.7'+'SANS3.6')/6</P> <P>The error I get when trying to save is</P> <P>Encountered the following error while trying to update: In handler 'views': Error parsing XML on line 9: StartTag: invalid element name</P> <P>Lots of the search is showing in RED when added to the dashboard code (but works is pasted into search without the rangemap text)</P> <P>&lt;search&gt;<BR /> &lt;query&gt;| dbquery "database" "SELECT * FROM new_compliancelist"| stats count(eval(FAILED&lt;1)) as success count as total| eval SANS31 = success/total*100 |fields SANS31 | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.2" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.2] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.3" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.3] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.6" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.6] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.7" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.7] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.10" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.10] | eval SANS3=('SANS31'+'SANS3.2'+'SANS3.3'+'SANS3.10'+'SANS3.7'+'SANS3.6')/6 | rangemap field=SANS3 elevated=51-84 low=85-100 severe=0-50 default=none&lt;/query&gt;<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> <STRONG></STRONG></P> Mon, 28 Sep 2020 20:00:27 GMT https://community.splunk.com/t5/Dashboards-Visualizations/search-not-working-in-dashboard/m-p/116283#M6693 crossap 2020-09-28T20:00:27Z Re: search not working in dashboard https://community.splunk.com/t5/Dashboards-Visualizations/search-not-working-in-dashboard/m-p/116284#M6694 <P>hi crosssap,<BR /> it is a beacon problem is that has not been closed or badly positioned, can you post all your xml so that we may identify the problem?</P> Thu, 21 May 2015 10:58:41 GMT https://community.splunk.com/t5/Dashboards-Visualizations/search-not-working-in-dashboard/m-p/116284#M6694 gyslainlatsa 2015-05-21T10:58:41Z Re: search not working in dashboard https://community.splunk.com/t5/Dashboards-Visualizations/search-not-working-in-dashboard/m-p/116285#M6695 <P>I would imagine your search contains characters that interrupt the xml (I can't pinpoint one exactly though).</P> <P>Have you tried the second solution from the <A href="http://answers.splunk.com/answers/44365/xml-editor-in-splunk-doesnt-like-angle-brackets-in-searches.html">answer to this question</A>? Basically you just enclose your entire search with</P> <PRE><CODE>&lt;![CDATA[ </CODE></PRE> <P>before and </P> <PRE><CODE>]]&gt; </CODE></PRE> <P>after.</P> Thu, 21 May 2015 11:07:49 GMT https://community.splunk.com/t5/Dashboards-Visualizations/search-not-working-in-dashboard/m-p/116285#M6695 jeffland 2015-05-21T11:07:49Z Re: search not working in dashboard https://community.splunk.com/t5/Dashboards-Visualizations/search-not-working-in-dashboard/m-p/116286#M6696 <P>Hi,</P> <P>Hope this pastes ok as I cant attach a file (karma points)</P> <P>SANS 20 OVERVIEW</P> <PRE><CODE>&lt;panel&gt; &lt;title&gt;SANS 1&lt;/title&gt; &lt;single&gt; &lt;title&gt;Authorized &amp;amp; Unauthorized Devices&lt;/title&gt; &lt;search&gt; </CODE></PRE> <P>| dbquery "database" "SELECT * FROM new_compliancelist"| stats count(eval(FAILED&lt;1)) as success count as total | eval value = success/total*100 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> <BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> <BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_1" target="_blank">Additional Information</A> <BR /> <BR /> <PANEL><BR /> <TITLE>SANS 2</TITLE><BR /> <SINGLE><BR /> <TITLE>Authorized &amp; Unauthorized Software</TITLE><BR /> <SEARCH><BR /> <QUERY>| stats count as value | eval value = 0 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none</QUERY><BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_2" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 3</TITLE><BR /> <SINGLE><BR /> <TITLE>Secure Configurations for Hardware &amp; Software</TITLE><BR /> <SEARCH><BR /> | dbquery "database" "SELECT * FROM new_compliancelist"| stats count(eval(FAILED&lt;1)) as success count as total| eval SANS31 = success/total*100 |fields SANS31 | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.2" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.2] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.3" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.3] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.6" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.6] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.7" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.7] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.10" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.10] | eval SANS3=('SANS31'+'SANS3.2'+'SANS3.3'+'SANS3.10'+'SANS3.7'+'SANS3.6')/6 | rangemap field=SANS3 elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_3" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 4</TITLE><BR /> <SINGLE><BR /> <TITLE>Continuous Vulnerability Assesment</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 95 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_4" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 5</TITLE><BR /> <SINGLE><BR /> <TITLE>Malware and Anti virus Defenses</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 95 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_5" target="_blank">Additional Information</A> <BR /> </PANEL></P> <PRE><CODE>&lt;panel&gt; &lt;title&gt;SANS 6&lt;/title&gt; &lt;single&gt; &lt;title&gt;Application Software&lt;/title&gt; &lt;search&gt; </CODE></PRE> <P>| stats count as value | eval value = 20 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> <BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> <BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_6" target="_blank">Additional Information</A> <BR /> <BR /> <PANEL><BR /> <TITLE>SANS 7</TITLE><BR /> <SINGLE><BR /> <TITLE>Wireless Access Control</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 25 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_7" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 8</TITLE><BR /> <SINGLE><BR /> <TITLE>Data Recovery Capability</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 25 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_8" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 9</TITLE><BR /> <SINGLE><BR /> <TITLE>Secure Skills Assesment</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 10 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_9" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 10</TITLE><BR /> <SINGLE><BR /> <TITLE>Secure Configurations</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 10 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_10" target="_blank">Additional Information</A> <BR /> </PANEL></P> <PRE><CODE>&lt;panel&gt; &lt;title&gt;SANS 11&lt;/title&gt; &lt;single&gt; &lt;title&gt;Limitation &amp;amp; Control of Network Ports, Protocols&lt;/title&gt; &lt;search&gt; </CODE></PRE> <P>| stats count as value | eval value = 25 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> <BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> <BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_11" target="_blank">Additional Information</A> <BR /> <BR /> <PANEL><BR /> <TITLE>SANS 12</TITLE><BR /> <SINGLE><BR /> <TITLE>Controlled use of Administrative Privileges</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 60 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans12_" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 13</TITLE><BR /> <SINGLE><BR /> <TITLE>Boundary Defense</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 70 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_13" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 14</TITLE><BR /> <SINGLE><BR /> <TITLE>Monitoring of Logs</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 20 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_14" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 15</TITLE><BR /> <SINGLE><BR /> <TITLE>Controlled Access based on Need to Know</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 20 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_15" target="_blank">Additional Information</A> <BR /> </PANEL></P> <PRE><CODE>&lt;panel&gt; &lt;title&gt;SANS 16&lt;/title&gt; &lt;single&gt; &lt;title&gt;Account Monitoring &amp;amp; Control&lt;/title&gt; &lt;search&gt; </CODE></PRE> <P>| stats count as value | eval value = 25 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> <BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> <BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_16" target="_blank">Additional Information</A> <BR /> <BR /> <PANEL><BR /> <TITLE>SANS 17</TITLE><BR /> <SINGLE><BR /> <TITLE>Data Protection</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 30 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_17" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 18</TITLE><BR /> <SINGLE><BR /> <TITLE>Incident Response &amp; Management</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 25 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_18" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 19</TITLE><BR /> <SINGLE><BR /> <TITLE>Secure Network Engineering</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 14 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_19" target="_blank">Additional Information</A> <BR /> </PANEL><BR /> <PANEL><BR /> <TITLE>SANS 20</TITLE><BR /> <SINGLE><BR /> <TITLE>Penetration Tests</TITLE><BR /> <SEARCH><BR /> | stats count as value | eval value = 95 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none<BR /> <EARLIEST>-15m</EARLIEST><BR /> <LATEST>now</LATEST><BR /> </SEARCH><BR /> range<BR /> value<BR /> ellipsisNone<BR /> 0<BR /> visible<BR /> visible<BR /> visible<BR /> linear<BR /> linear<BR /> false<BR /> inherit<BR /> radialGauge<BR /> 50<BR /> 10<BR /> area<BR /> gaps<BR /> 0.01<BR /> default<BR /> shiny<BR /> all<BR /> 0<BR /> ellipsisMiddle<BR /> right<BR /> search<BR /> [0,49,84,100]<BR /> [0xd13b3b,0xebe42d,0x7e9f44]<BR /> none<BR /> </SINGLE><BR /> <A href="https://lonp-splunk/en-GB/app/Sans_Pmc/sans_20" target="_blank">Additional Information</A> <BR /> </PANEL></P> Mon, 28 Sep 2020 20:00:29 GMT https://community.splunk.com/t5/Dashboards-Visualizations/search-not-working-in-dashboard/m-p/116286#M6696 crossap 2020-09-28T20:00:29Z Re: search not working in dashboard https://community.splunk.com/t5/Dashboards-Visualizations/search-not-working-in-dashboard/m-p/116287#M6697 <P>Is there another way I can post all of the xml? due to the crazy formatting that comes through</P> Thu, 21 May 2015 11:10:41 GMT https://community.splunk.com/t5/Dashboards-Visualizations/search-not-working-in-dashboard/m-p/116287#M6697 crossap 2015-05-21T11:10:41Z Re: search not working in dashboard https://community.splunk.com/t5/Dashboards-Visualizations/search-not-working-in-dashboard/m-p/116288#M6698 <P>Hi,</P> <P>I tried this and the XML is saving now but its only actually doing the first calculation not the entire part</P> <P>&lt;query&gt;&lt;![CDATA[ | dbquery "database" "SELECT * FROM new_compliancelist"| stats count(eval(FAILED&lt;1)) as success count as total| eval SANS31 = success/total*100 |fields SANS31 | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.2" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.2] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.3" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.3] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.6" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.6] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.7" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.7] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.10" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.10] | eval SANS3=('SANS31'+'SANS3.2'+'SANS3.3'+'SANS3.10'+'SANS3.7'+'SANS3.6')/6 | rangemap field=SANS3 elevated=51-84 low=85-100 severe=0-50 default=none]]&gt;&lt;/query&gt;</P> Thu, 21 May 2015 11:28:14 GMT https://community.splunk.com/t5/Dashboards-Visualizations/search-not-working-in-dashboard/m-p/116288#M6698 crossap 2015-05-21T11:28:14Z Re: search not working in dashboard https://community.splunk.com/t5/Dashboards-Visualizations/search-not-working-in-dashboard/m-p/116289#M6699 <P>Have you checked what exact search is run when the dashboard is opened?</P> Thu, 21 May 2015 11:47:02 GMT https://community.splunk.com/t5/Dashboards-Visualizations/search-not-working-in-dashboard/m-p/116289#M6699 jeffland 2015-05-21T11:47:02Z Re: search not working in dashboard https://community.splunk.com/t5/Dashboards-Visualizations/search-not-working-in-dashboard/m-p/116290#M6700 <P>Hi,</P> <P>Do you check this by clicking to edit the search string? if so its as expeted</P> <P>anything weird like it needs to be appendcols rather than join?</P> Thu, 21 May 2015 12:07:32 GMT https://community.splunk.com/t5/Dashboards-Visualizations/search-not-working-in-dashboard/m-p/116290#M6700 crossap 2015-05-21T12:07:32Z Re: search not working in dashboard https://community.splunk.com/t5/Dashboards-Visualizations/search-not-working-in-dashboard/m-p/116291#M6701 <P>Hi,</P> <P>I managed to get this working by adding </P> <P>| fields SANS3 just before the | range</P> <P>thanks!</P> Thu, 21 May 2015 12:50:45 GMT https://community.splunk.com/t5/Dashboards-Visualizations/search-not-working-in-dashboard/m-p/116291#M6701 crossap 2015-05-21T12:50:45Z