Dashboards & Visualizations
Highlighted

Error in User input for dashboard to check a specific IP

Observer

Hi, i am having an error of getting this user input for a drop-down to work where i am unable to find any errors within my code. Can somebody help me for this error?

 This is the error i am getting.

codywsj_0-1593524482948.png

This is my search query

(sourcetype="windows event logs" OR sourcetype="General-linux-sql.log" OR sourcetype="csv")
| eval spec_IP=case ([|search sourcetype="General-linux-sql.log"],
[| rex field=_raw "\[(?<IP_addr>\d+.\d+.\d+.\d+)\]"],
[| search sourcetype="csv"],
[| rex field=_raw ",(?<src_ip>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}),\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3},,,"],
[| search sourcetype="windows event logs"],
[| search *"Account Locked"*
| rex field=_raw "\[(?<acc_ip>\d+.\d+.\d+.\d+)\]"]
)
| stats count by Specific_IP


Labels (4)
Tags (2)
0 Karma
Highlighted

Re: Error in User input for dashboard to check a specific IP

SplunkTrust
SplunkTrust
That error can happen if one or more of the subsearches returns no results. Check each subsearch to make sure it works by itself - I am suspicious of the "| rex ... " subsearches. Remember that subsearches execute before the main search so they must be valid stand-alone searches.
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.