topic Re: Why does my search work in the Search App, but not as an inline search in a dashboard? in Splunk Search

Why does my search work in the Search App, but not as an inline search in a dashboard?

edrivera3 — Mon, 20 Apr 2015 16:28:18 GMT

I have the following search that works correctly in the search app, but when I tried to include it as an inline search in the dashboard, it doesn't work.

index="job_event" | search error_number=05071 | eval "ACS Name"=acs_name | chart dedup_splitvals=t limit=100 useother=f count AS "# of Errors"  by "ACS Name" test_number format=$VAL$:::$AGG$ | sort limit=100 acs_name | fields - _span  | fields "ACS Name" *

I already checked that all extracted fields have permission to appear in all apps and users.
I also tried to change all quotation marks to & quot; but nothing changed.

Re: Why does my search work in the Search App, but not as an inline search in a dashboard?

krwinters11 — Mon, 20 Apr 2015 18:02:54 GMT

I am also interested in an answer to this, as I have a similar question out that involves this issue and using the R Project app. http://answers.splunk.com/answers/229941/why-does-an-r-search-not-work-on-a-dashboard.html

Re: Why does my search work in the Search App, but not as an inline search in a dashboard?

Flynt — Mon, 20 Apr 2015 18:29:59 GMT

You'll need to double escape the VAL and AGG as single $'s mean look for a token in a dashboard.

Try this

 index="job_event" | search error_number=05071 | eval "ACS Name"=acs_name | chart dedup_splitvals=t limit=100 useother=f count AS "# of Errors"  by "ACS Name" test_number format=$$VAL$$:::$$AGG$$ | sort limit=100 acs_name | fields - _span  | fields "ACS Name" *

In your dashboard.

Re: Why does my search work in the Search App, but not as an inline search in a dashboard?

edrivera3 — Mon, 20 Apr 2015 18:55:53 GMT

It worked perfectly. Thank you.