topic Re: Why are my dashboard panels using a base search showing no results, but shows results if opened in search? in Splunk Search

Why are my dashboard panels using a base search showing no results, but shows results if opened in search?

hettervik — Tue, 09 Feb 2016 08:33:27 GMT

Hi,

I've encountered this problem a couple of times now.

I have a dashboard where some of the panels run on a base search to save computing power. When I open the dashboard the panels using the base search are showing zero results, but if I open them in search I get the results I want. I'll provide the XML. Why could it be that this is happening? Is there some sort of missing capability that prevents me from seeing the results in the dashboard or app even though I can see the correct results when the panel is opened in search?

<search id="manageStoreEmployee">
    <query>eventtype=a OR eventtype=b</query>
    <earliest>$token_time_picker.earliest$</earliest>
    <latest>$token_time_picker.latest$</latest>
</search>

<panel>
      <title>Manage Store Employee - Front-End</title>
      <single>
        <search base="manageStoreEmployee">
          <query>| stats count(eval(status!=422)) as success</query>
        </search>
      </single>
</panel>
<panel>
      <title>Manage Store Employee - Back-End</title>
      <single>
        <search base="manageStoreEmployee">
          <query>| stats count(eval(status!=502)) as success</query>
        </search>
      </single>
</panel>

Re: Why are my dashboard panels using a base search showing no results, but shows results if opened in search?

renjith_nair — Tue, 09 Feb 2016 08:52:10 GMT

Can you try this in your base search

eventtype="a" OR eventtype="b" | fields status, other fields

It's possible that filed extraction is not happening in dashboard since it runs search in smart mode by default

Re: Why are my dashboard panels using a base search showing no results, but shows results if opened in search?

hettervik — Tue, 09 Feb 2016 09:26:36 GMT

That worked perfectly, I'd never thought of that being the problem. Thanks a lot!

Re: Why are my dashboard panels using a base search showing no results, but shows results if opened in search?

chuckers — Fri, 30 Sep 2016 21:58:50 GMT

More generically, put a

| fields *

at the end of the base query. This will make certain that you have all the fields you need for all the other panels that might reference that base.

Re: Why are my dashboard panels using a base search showing no results, but shows results if opened in search?

cpershey — Tue, 07 Nov 2017 19:33:01 GMT

this answer fixed my dashboard

Re: Why are my dashboard panels using a base search showing no results, but shows results if opened in search?

christoffertoft — Thu, 11 Jan 2018 08:23:19 GMT

Thank you for this.. Solved my issue

Re: Why are my dashboard panels using a base search showing no results, but shows results if opened in search?

edoardo_vicendo — Thu, 08 Mar 2018 11:17:03 GMT

Thanks, this suggestion fixed my issue

Re: Why are my dashboard panels using a base search showing no results, but shows results if opened in search?

edoardo_vicendo — Thu, 08 Mar 2018 12:36:10 GMT

I woud add that, instead of using:

| fields *

it is better to extract only the fields you need later on in all the other dashboard panels, this will improve the performance of the entire dashboard, here below the example:

| fields field1, field2, field3 etc..