topic Re: Splunk Mobile Access Server - No search query provided error when accessing dashboards in Splunk Search

Splunk Mobile Access Server - No search query provided error when accessing dashboards

TritonDrew — Tue, 30 Dec 2014 20:55:07 GMT

Splunk 6.2 installed and everything is working great. Installed the Mobile Access server and I can't view any dashboards, even simple ones. Reports work fine and the 6.x examples work with no problems. Getting a "No search query provided". Funny thing is when I export to a PDF from that dashboard the data looks good. Any ideas?

Re: Splunk Mobile Access Server - No search query provided error when accessing dashboards

TritonDrew — Tue, 30 Dec 2014 22:58:55 GMT

Found out the problem. Inline search was creating search queries with a format the Mobile Access Server didn't recognize. Used to replace inline search and it works. SimpleXML issue?

Re: Splunk Mobile Access Server - No search query provided error when accessing dashboards

andrewsb — Sat, 03 Jan 2015 08:45:07 GMT

What did you use to replace the inline searches? This is driving me nuts as well...

Re: Splunk Mobile Access Server - No search query provided error when accessing dashboards

swasserroth — Thu, 08 Jan 2015 20:11:11 GMT

I have run into the same problem: all dashboards I have created resulted in "No search query provided".

After installing the "Dashboard Examples" I probably found the difference between these dashboards and the dashboards created in Splunk 6.2.1 by looking at the XML code differences:
- Splunk-created dashboards contain the query strings inside a <query> markup,
- the dashboard examples (i.e. "chart") are using the <searchString> markup.

After manual conversion of the XML code of Splunk-created dashboards to a format identical to the "chart" example, the dashboard worked on the iPad as expected.

It seems not to be an issue of using inline searches or not...