Hi,
In Splunk Stream app (v7.1.2) there is a panel named Query on the DNS Activity dashboard. For me it is empty, the query its use:
index=* source="stream:Splunk_DNSRequestResponse" | rename count as counts query as Query | eval error=if(reply_code!="NoError", counts, 0) | stats sum(counts) as Counts sum(error) as Errors by Query | sort Counts desc
If I add | spath query to the query its works:
index=* source="stream:Splunk_DNSRequestResponse" | spath query | rename count as counts query as Query | eval error=if(reply_code!="NoError", counts, 0) | stats sum(counts) as Counts sum(error) as Errors by Query | sort Counts desc
Question: can I fix this panel without modifying the query? I don't like to create custom confs in a factory app. Its just makes problems during an upgrade...
Update: I found a similar problem with the "Resolution Integrity" panel, too.
Regards,
István
