Splunk 6.x Dashboard Examples: Why am I getting error "No search query provided" when I execute the Post Process Search?

[laxman413]

I have installed the Splunk 6.x Dashboard Examples app and when I execute the "Post Process Search" I receive the "No search query provided" error in all of the panels of the dashboard. What am I missing?

[nfilippi_splunk]

This is expected behavior.

In Splunk 6.2, the syntax for search has been greatly enhanced, where the Splunk 6.x Dashboard Examples v3.0 has also been updated to reflect these changes. If you refer to the main examples page, there is a compatibility label that indicates, for these search specific examples, they are only compatible with Splunk 6.2.

If you are interested in post process search examples that are compatible with 6.1, I would recommend downgrading the app to v2.0.1.

[laxman413]

I am using Splunk Dashbaord 6 Examples and the app version is 3 and my Splunk version is 6.1.3

[ppablo]

Cool thanks for the info. I needed to edit the post appropriately to tag the right app and make the question/content more concise. 🙂

[ppablo]

Hi @laxman413

Which Dashboard Examples App are you referring to?

Splunk Dashboard Examples (which is for Splunk 5.x) or Splunk 6.x Dashboard Examples?