I've got a basic question on how to troubleshoot something that I am seeing from time to time. I have some searches that work fine when entered as an interactive search. But when I take the same search and put it into a dashboard panel, all I get is "...". I don't want to get into the actual search so much, but I need a bit of guidance on how to fish, as it were. But for example, I'm doing something like this:
I know this is an old question, but for the sake of posterity I will give you an answer.
You could look at the search.log located on your server and see if there is anything of interest there.
The data in search.log is not indexed in _internal like a lot of other splunk in internal data. You can even access it by looking for the job in the user interface and down at the bottom of the inspect job page you will see a link to search.log.