Dashboards & Visualizations

Error in User input for dashboard to check a specific IP

codywsj
Loves-to-Learn

Hi, i am having an error of getting this user input for a drop-down to work where i am unable to find any errors within my code. Can somebody help me for this error?

 This is the error i am getting.

codywsj_0-1593524482948.png

This is my search query

(sourcetype="windows event logs" OR sourcetype="General-linux-sql.log" OR sourcetype="csv")
| eval spec_IP=case ([|search sourcetype="General-linux-sql.log"],
[| rex field=_raw "\[(?<IP_addr>\d+.\d+.\d+.\d+)\]"],
[| search sourcetype="csv"],
[| rex field=_raw ",(?<src_ip>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}),\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3},,,"],
[| search sourcetype="windows event logs"],
[| search *"Account Locked"*
| rex field=_raw "\[(?<acc_ip>\d+.\d+.\d+.\d+)\]"]
)
| stats count by Specific_IP


Labels (4)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
That error can happen if one or more of the subsearches returns no results. Check each subsearch to make sure it works by itself - I am suspicious of the "| rex ... " subsearches. Remember that subsearches execute before the main search so they must be valid stand-alone searches.
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...