Dashboards & Visualizations

Dashboard doesn't show any results depending on the nature of the content being shown

brettcave
Builder

I have a dashboard that runs a base search, and has panels that populate from it. One of the panels has a custom drilldown that sets a token, and that token is used by another panel.

 

<search id="basesearch"></search>
<panel><title>panel</title><search base="basesearch"><query>| chart c by Name
  <drilldown><set token="subpanelfilter">$row.Name$</set></drilldown>
</panel>
<panel><title>subpanel</title><search base="basesearch">
  <query>| search Name="$subpanelfilter$"
    | chart c over SomeOtherField by SomethingElse
  </query>
</panel>

 

 

The results rendered in "subpanel" either show "No Results" or a list of valid results, depending on what I use for the "chart over" value. For example, if i "chart over AFieldWithLongText" then I get No Results, but if I chart over a different field, results populate.

1 of the fields I am working with is called "Title". An example of Title might be something with this sort of text pattern (to indicate length and the sort of characters found):

     1.18 Do not allow the "quick brown fox" to jump over the lazy dog.

 

Even if I use `| table Title SomeOtherField`, the "Title" column is just cut out, and only "SomeOtherField" is rendered (so it renders the same as if I'd used "| table SomeOtherField").

What could be causing the results to not render because of field characteristics?

 

Thanks in advance.

Labels (2)
0 Karma

niketn
Legend

@brettcave try to have transforming search in your base search and also restrict to fields that are required. Do not use Post Processing to retain all event and fields as is to be used across the dashboard. Refer to one of my older answer around the same along with best practices for Post Processing: https://community.splunk.com/t5/Splunk-Search/Why-do-my-post-process-timecharts-display-quot-no-resu...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

brettcave
Builder

Oh - and if I "Open In Search" from the dashboard, the results load as expected. So it looks like it's related purely to loading in the dashboard.

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...