I am working on migrating some items over to dashboard studio. I have a very simple stats command getting a few counts. One item I have is to just get an average response time, avg(responseTime). When I put this into my search the column doesnt get results, other columns like count(eval(status=OK)) populate fine. Also if select to run the item as just a search it works fine and all my data shows. Anyone else have similar issues?
Hi @aohls does the same search work if you apply it to another visualization in the dashboard, like a table? Would you be willing to share the dashboard definition so I can take a look? You can also send it to dashboard-studio@splunk.com instead of posting here.
Is it possible for you to share the entire search? I've built quite a few dashboards using this framework and would be curious to troubleshoot what might be going on here.
Its a pretty straightforward search. Below is the search just with made up names for things.
index=service
|stats count as "Total", avg(reponse) as "Response" by Request
|eval Response=round(Response,2)
| table Request, Total, Response
I don't see anything for Response in the dashboard but once I click the magnifying glass to the search tab I see everything for that column. I have the first line as the base search and the rest as a chain referencing that base search. If I move everything to a single search it works fine though.
Have you been able to solve this?
I'm on 9.4.4 and experience the same error with an extremely rudimentary search
index=my_index host IN (foo,bar,baz)
| table _time host ComputerName Account_Domain EventCode eventtype name category severity_id severity TypeAll fields after host refuse to populate in Dashboard Studio, but they populate in search AND in Classic Dashboards
Hi @themessik is your query 1 search, or is it broken into a base and chain search?
Hi,
Base search, this is still on the Classic XML Dashboards.
Weird thing is, I haven't touched the thing in a week and during checking for you I see that the tables have started populating correctly... Which is odd to say the least.