Splunk 6.0 dashboards ignoring top

[krugger]

Hi,

I have installed Splunk 6.0 for testing before upgrading my current production environment. Everything is rather new, but I am having trouble getting a simple dashboard to work, because the piping through top doesn't seem to work. It just displays the events as a list and not aggregated in a top 10. However if I run the inline search in Search it will display a properly formatted table.

I have read the Build dashboards in Splunk Web of the new 6.0 manual, but it doesn't seem to have anything special about it.

What am I missing? Can it be related to my data model definitions?

[krugger · Accepted solution]

ineeman and melting, you are both correct.

Changing to a statistics table makes the result of top show again.

[melting]

Could you provide the xml you are trying?

Possible you would like to use table tag in place of event tags - Event in 6.0 will always show the events vs results which come from reporting commands like top.

Or post screenshot.

[ineeman]

Could you post the XML definition of your dashboard? I'm wondering if it is somehow set to an events panel, in which case it would show up the events that are behind your "top" query.