The below snip from my dashboard works fine when we run in the query in straight spl, however, when run via Dashboard Panel, I can see the proper query in the inspector but for some reason (I don't know why) it doesn't show any results.
Note: When I go down towards the inspector and select "open in search" I see the expected results.
Any ideas? I've tried opening up the permissions yet still nothing. I would provide more details but I can't think of anything else that matters.
Thank you in advance.
<row>
<panel>
<title>IP Lookup</title>
<input type="text" token="the_ip" searchWhenChanged="true">
<label>IP</label>
</input>
<event>
<title>IP Lookup</title>
<search>
<query>| inputlookup ip_list.csv where ip=$the_ip$</query>
<earliest>-15m</earliest>
<latest>now</latest>
</search>
<option name="list.drilldown">none</option>
</event>
</panel>
</row>
I figured it out. Very frustrating issue to experience.
https://answers.splunk.com/answers/228414/dashboard-issues-search-runs-in-search-window-not.html
Bottom line, change to stats instead of events view. The html above should be in a table section rather than an event wrapped section.
I figured it out. Very frustrating issue to experience.
https://answers.splunk.com/answers/228414/dashboard-issues-search-runs-in-search-window-not.html
Bottom line, change to stats instead of events view. The html above should be in a table section rather than an event wrapped section.
your input is not set <default>
, so $the_ip$
token has no value.
Hi, Thank you for the reply.
I've tried adding an example IP:
192.168.123.123
Into the input section above - still not helping. If I copy/paste the query out of the inspection drilldown, it shows output successfully.
Is it possible my problem is outside of the "Row" section above?
<query>| inputlookup ip_list.csv where ip="$the_ip$"</query>
eval need "
with string.