The below snip from my dashboard works fine when we run in the query in straight spl, however, when run via Dashboard Panel, I can see the proper query in the inspector but for some reason (I don't know why) it doesn't show any results.
Note: When I go down towards the inspector and select "open in search" I see the expected results.
Any ideas? I've tried opening up the permissions yet still nothing. I would provide more details but I can't think of anything else that matters.
Thank you in advance.
<row> <panel> <title>IP Lookup</title> <input type="text" token="the_ip" searchWhenChanged="true"> <label>IP</label> </input> <event> <title>IP Lookup</title> <search> <query>| inputlookup ip_list.csv where ip=$the_ip$</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="list.drilldown">none</option> </event> </panel> </row>
Hi, Thank you for the reply.
I've tried adding an example IP:
Into the input section above - still not helping. If I copy/paste the query out of the inspection drilldown, it shows output successfully.
Is it possible my problem is outside of the "Row" section above?
I figured it out. Very frustrating issue to experience.
Bottom line, change to stats instead of events view. The html above should be in a table section rather than an event wrapped section.