Dashboards & Visualizations

No matching fields exist

Narj
Path Finder

Hi all,

I'm getting a blue bar with "No matching fields exist" at the top of one of my dashboards. The funny thing is that all of the panels are populating.

I did rename the App by renaming the directory (I went through and changed the role's default app as well - and didn't have any private searches etc). So, I'm a bit paranoid that this may have caused the issue. I did restart Splunk afterwards.

Are there any log files I can check that might point out where the issue is?

Thanks!

Tags (2)
0 Karma
1 Solution

helge
Builder

To get rid of this, you need to have your dashboard in advanced XML mode. Add the following to the Message module:

<param name="level">warn</param>

The full Module section might look like this:

<module name="Message" layoutPanel="messaging">
   <param name="filter">*</param>
   <param name="clearOnJobDispatch">False</param>
   <param name="maxSize">1</param>
   <param name="level">warn</param>
</module>

View solution in original post

helge
Builder

To get rid of this, you need to have your dashboard in advanced XML mode. Add the following to the Message module:

<param name="level">warn</param>

The full Module section might look like this:

<module name="Message" layoutPanel="messaging">
   <param name="filter">*</param>
   <param name="clearOnJobDispatch">False</param>
   <param name="maxSize">1</param>
   <param name="level">warn</param>
</module>

Narj
Path Finder

Hi all,OK for starters, it turns out that my field extraction was not working under certain circumstances. That's fixed but I'm still getting the alert on a 12 hour timespan, whereas I don't on a 7 day one.After some investigation, it seems that the error is coming from me using the "table" command... when there are no results, it flags up.Is there a way of getting around this? ie: don't bother running the table command if there are no results? 🙂

0 Karma

Narj
Path Finder

Aha... removing one panel at a time has helped identify the culprit, although I have no idea why it's throwing up this error in the dashboard. Will post back with findings!

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...