Dashboard Panel Not Populating Unless Converted to Report

[aohls]

I am in the process of creating a dashboard with some inputs that get passed down to some panel tables. I am running into an issue where my dashboard panel is not populating a specific table column but, when I convert the panel to a report there is no issue. Is this a known issue or does anyone have an idea of what might be going on? I can include search syntax but since it works once it gets converted it clearly seems to work. Not a huge deal overall but more of an inconvenience.

Edit: My whole dashboard seems buggy. I can get results in my filters but, if I resave, even if nothing has changed, the multiselect I have breaks and no results are returned; even though I just had results. I am using a custom built function. Are there any known issues with using these in dashboards?

I did see a post that said _time might be an issue but that is not the case, I removed it and tested it with the same result.

[renjith_nair · Accepted solution]

Hi @aohis,

Try explicitly mentioning the field in your dashboard for eg. fields field1,2,3, and try again. By default splunk runs in "smart mode" and field extraction might not be done implicitly. https://docs.splunk.com/Documentation/Splunk/7.1.1/Search/Changethesearchmode

[aohls]

When attempting this I am still getting the same results. Nothing populates for my field in the dashboard but, if I run it in search I am getting results.

[renjith_nair]

would you mind sharing the search used in dashboard? and also check the time range n both cases i.e. dashboard and search?

[aohls]

"with POST CONDITIONS"
| search $host.name$
| rex field=_raw "Invoked:(?<Task>\w*).xml"
| rex field=_raw "Value:(?<HostTask>\w+-?\w+-?\w+\s?\w+?-?\w+\w+?-?\w+?\w+?\w+?\w+?)"
| table HostTask,Task,_time

Above is my search. $host.name$ name is coming from a multi select button. I have reviewed that multiple times and the syntax there works correctly; I even removed it and hard coded what gets fed into the search from the multi select, still HostTask does not populate.

[renjith_nair]

fields will bring the extracted field as well. So just try fields instead of table . And also make sure that you don't have any fields/table command in your base search which might have omitted the _raw