Dashboards & Visualizations

IP Lookup Dashboard Panel

Path Finder

The below snip from my dashboard works fine when we run in the query in straight spl, however, when run via Dashboard Panel, I can see the proper query in the inspector but for some reason (I don't know why) it doesn't show any results.

Note: When I go down towards the inspector and select "open in search" I see the expected results.

Any ideas? I've tried opening up the permissions yet still nothing. I would provide more details but I can't think of anything else that matters.

Thank you in advance.

  <row>
    <panel>
      <title>IP Lookup</title>
      <input type="text" token="the_ip" searchWhenChanged="true">
        <label>IP</label>
      </input>
      <event>
        <title>IP Lookup</title>
        <search>
          <query>| inputlookup ip_list.csv where ip=$the_ip$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
0 Karma
1 Solution

Path Finder

I figured it out. Very frustrating issue to experience.

https://answers.splunk.com/answers/228414/dashboard-issues-search-runs-in-search-window-not.html

Bottom line, change to stats instead of events view. The html above should be in a table section rather than an event wrapped section.

View solution in original post

0 Karma

Path Finder

I figured it out. Very frustrating issue to experience.

https://answers.splunk.com/answers/228414/dashboard-issues-search-runs-in-search-window-not.html

Bottom line, change to stats instead of events view. The html above should be in a table section rather than an event wrapped section.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

your input is not set <default>, so $the_ip$ token has no value.

0 Karma

Path Finder

Hi, Thank you for the reply.

I've tried adding an example IP:
192.168.123.123

Into the input section above - still not helping. If I copy/paste the query out of the inspection drilldown, it shows output successfully.

Is it possible my problem is outside of the "Row" section above?

0 Karma

SplunkTrust
SplunkTrust

<query>| inputlookup ip_list.csv where ip="$the_ip$"</query>
eval need " with string.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!