How to troubleshoot a search that works interactively, but not in a dashboard

[halr9000]

I've got a basic question on how to troubleshoot something that I am seeing from time to time. I have some searches that work fine when entered as an interactive search. But when I take the same search and put it into a dashboard panel, all I get is "...". I don't want to get into the actual search so much, but I need a bit of guidance on how to fish, as it were. But for example, I'm doing something like this:

index=foo | dedup field1 | append [ bar ] | lookup field2 | search field3=baz | stats count

Interactively, I get "7". Works all day long. Won't work in a single value panel, and I have no idea why, and don't know where I need to dig in order to find the answer.

[okrabbe_splunk]

I know this is an old question, but for the sake of posterity I will give you an answer.

You could look at the search.log located on your server and see if there is anything of interest there.

The data in search.log is not indexed in _internal like a lot of other splunk in internal data. You can even access it by looking for the job in the user interface and down at the bottom of the inspect job page you will see a link to search.log.

More info is available at this page : What does Splunk log about itself?