Dashboards & Visualizations

How to troubleshoot a search that works interactively, but not in a dashboard


I've got a basic question on how to troubleshoot something that I am seeing from time to time. I have some searches that work fine when entered as an interactive search. But when I take the same search and put it into a dashboard panel, all I get is "...". I don't want to get into the actual search so much, but I need a bit of guidance on how to fish, as it were. But for example, I'm doing something like this:

index=foo | dedup field1 | append [ bar ] | lookup field2 | search field3=baz | stats count

Interactively, I get "7". Works all day long. Won't work in a single value panel, and I have no idea why, and don't know where I need to dig in order to find the answer.

Splunk Employee
Splunk Employee

I know this is an old question, but for the sake of posterity I will give you an answer.

You could look at the search.log located on your server and see if there is anything of interest there.

The data in search.log is not indexed in _internal like a lot of other splunk in internal data. You can even access it by looking for the job in the user interface and down at the bottom of the inspect job page you will see a link to search.log.

More info is available at this page : What does Splunk log about itself?

0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...