Archive

Field missing in statistical table only, while present (with values) in search

Contributor

Dear all,

I have a dashboard table that does not display certain fields, which do have data - although not in every row - for the period searched.

The fields missing in the dashboard table are "group" and "rule".
when clicking the dashboard loop button - search in a new form - they do appear

Splunk version is 6.4.4.

the code is below:

<form>
  <label>Cisco FW Change 02</label>
  <search id="mc_unf_base">
    <query>index=net_firewall sourcetype=cisco:asa vendor_class=config user="*" command="*"</query>
    <earliest>$field_time.earliest$</earliest>
    <latest>$field_time.latest$</latest>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="field_time">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search base="mc_unf_base">
          <query>| table _time, host, user, src, group, rule, severity_level, command, change_description     
                 | rename host AS Firewall, user as User, src as "Client IP", severity_level as Severity</query>
        </search>
        <option name="wrap">false</option>
        <option name="rowNumbers">true</option>
        <option name="drilldown">row</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">16</option>
      </table>
    </panel>
  </row>
</form>

best regards
Altin

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Whenever you use a base search, you need to explicitly specify all fields that you need for later searches. So change your base search to this:

index=net_firewall sourcetype=cisco:asa vendor_class=config user="*" command="*"| fields _time, host, user, src, group, rule, severity_level, command, change_description

Secondly, using a base search without a summarising command is not ideal.

View solution in original post

SplunkTrust
SplunkTrust

Whenever you use a base search, you need to explicitly specify all fields that you need for later searches. So change your base search to this:

index=net_firewall sourcetype=cisco:asa vendor_class=config user="*" command="*"| fields _time, host, user, src, group, rule, severity_level, command, change_description

Secondly, using a base search without a summarising command is not ideal.

View solution in original post

Contributor

thank you very much @chrisyoungerjds

best regards
Altin

0 Karma

SplunkTrust
SplunkTrust

Are you seeing them when you run your search in search window? Also, if there are more than 10 results, they would appear in the next page. hope you have checked that in the table results.

index=net_firewall sourcetype=cisco:asa vendor_class=config user="" command="" |fillnull value="N/A" group, rule | stats count by group, rule

0 Karma

Contributor

thank you,

but it is not a matter of pages. I do see them in search, but not in the statistical (dashboard) table

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!