Unable to save log view from Log Observer

[b0lle]

Hey, 

I recently wanted to add a new log-view to an existing Dashboard at which I own. So, from the Log Oberserver, I created the query, clicked "Save" -> "Save to Dashboard", selected my Dashboard, activated the "Log View" radio button and clicked "Save an go to Dashboard".

This is the error I am facing: "Alert
Chart cannot be saved to the selected dashboard. Check your permissions and try again. If the problem persists, contact support."

I checked those permissions on the Dashboard and those are "Everyone can read or write".

Has anyone an idea whats going on and how to solve this issue?

Thanks!

[b0lle]

anyone?

I also contacted Splunk Support some weeks ago and got no response

[livehybrid]

Hi @b0lle 

Is it possible for you to view the Developer Console for your browser and select the Network tab. When you click the button to save the panel to the dashboard can you see the API call being made? Can you check what the response is that is returned? It might give a bit more information.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[b0lle]

Hey, 

the response is: {
"code" : 400,
"message" : "Column name cannot be null or empty"
}

With this knowledge I deselected my columns one by one and found out that I can create the log-view in a dashboard, but only with the default columns "time" and "severity". If I try to select any of my custom columns it throws the mentioned error.