Tenant / index on Overview page tanking searches

[jamesjarrett]

I am not sure why but on the main page, none of the searches return results - unless i remove references to the indexes on the tstats search. I assume this is related to the multi tenancy support that is breaking it.

For example:

| tstats values(nodename) AS nodename count FROM datamodel=Cisco_IOS_Event WHERE Cisco_IOS_Event.product="IOS" index=* BY host index | search nodename=Cisco_IOS_Event | stats sum(count)

returns nothing, but:

| tstats values(nodename) AS nodename count FROM datamodel=Cisco_IOS_Event WHERE Cisco_IOS_Event.product="IOS"  BY host | search nodename=Cisco_IOS_Event | stats sum(count)

Works right.

The Tenant search properly hides as the macro probably comes back with nothing; i have assigned the tenant_index token with a value of "" to partially fix this issue..

Is this a known problem? or, is it something I have not set up correctly?

[mikaelbje]

Should be fixed in the latest 2.5.6 version of the app. Tested against recent Splunk versions.

[michaeljlancast]

I'm getting this error running on 6.6.7.

Error in 'PivotProcessor': Error in 'PivotUtil': The dataset 'Interface' has no field 'index'.

[michaeljlancast]

I'm not sure what happened, but the data models/pivots seemed to start working after a few days. Maybe another restart was required??

[russellliss]

I am getting the same error on 7.1.2

[xpac]

I'm not sure if I remember correctly, but did you try putting an AND between Cisco_IOS_Event.product="IOS" and index=*?

[jamesjarrett]

that's a possibility, but the thing is this is how the dashboard came packaged; i I guess i should have said something more along the lines of 'it was broken out of the box and removing index references fixed it'

[jamesjarrett]

i just want to know if there is something i missed in configuring.. or that i configured wrong which is completely a possibility