Dashboards & Visualizations

Why Simple XML dashboard using saved report is not rendering as it searches with panels saying "Waiting for data"?

jdunlea
Path Finder

I have a simple xml dashboard using two saved reports utilizing the stats command.

When I run either of these pretty simplistic reports individually in the search bar, the results start to pour onto the screen while the job continues to progress through the rest of the search.

However, when I have a simple xml dashboard that is driving two simple panels from these two saved reports, the panel seemingly does not render anything while the search job is running. Each panel says "Waiting for data".

However, when I replace the reference of the saved report with the actual search string, therefor running the search inline, the panels start to render data on the fly as the search is continuing to completion.

What is wrong here? I need to refernce the actual saved report as this report has been configured for report acceleration and I want the dashboard to use the accelerated summaries.

Anyone have ideas?! Here is a sample of the XML that is causing issues.

<dashboard>
  <label>MIP - Dashboard Name</label>
  <row>
    <panel>
      <table>
        <title>External Data Flow - Top Senders</title>
               <searchName>MIP Search 1</searchName>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>External Data Flow by Category</title>
        <searchName>MIP Search 2</searchName>
      </table>
    </panel>
  </row>
</dashboard>

The XML that allows the panel to render results while the rest of the search completes is as follows. It is simply replacing search 1 with the direct SPL of that search:

<dashboard>
   <label>MIP - Dashboard Name</label>
   <row>
     <panel>
       <table>
         <title>External Data Flow - Top Senders</title>
                <searchString>index=myindex foo AND bar| stats count by field1 field2 field3</searchString>
       </table>
     </panel>
   </row>
   <row>
     <panel>
       <table>
         <title>External Data Flow by Category</title>
         <searchName>MIP Search 2</searchName>
       </table>
     </panel>
   </row>
 </dashboard>
0 Karma
1 Solution

somesoni2
Revered Legend

Intead of below syntax

 <searchName>MIP Search 1</searchName>

try this

 <searchString>| savedsearch "MIP Search 1"</searchString>

View solution in original post

0 Karma

ngatchasandra
Builder

Hi,

you can have a problem with your spelling savedSearch name! Then verify if you call your report exactly or verify if you give permissions for all apps !

See my example! I have two savedSearch who is name testtsplunkd and License Usage Data Cube, my XML code that folllow shows the results in the two panels:

<dashboard>
   <label>MIP - Dashboard Name</label>
   <row>
     <panel>
       <table>
         <title>External Data Flow - Top Senders</title>
                <searchName>testtsplunkd</searchName>
       </table>
     </panel>
   </row>
   <row>
     <panel>
       <table>
         <title>External Data Flow by Category</title>
         <searchName>License Usage Data Cube</searchName>
       </table>
     </panel>
   </row>
 </dashboard>
0 Karma

somesoni2
Revered Legend

Intead of below syntax

 <searchName>MIP Search 1</searchName>

try this

 <searchString>| savedsearch "MIP Search 1"</searchString>
0 Karma

jdunlea
Path Finder

This worked. However it doesnt explain the previous behavior?

Either way I have converted all panels to inline searches so that I can use filtering and form inputs. But thank you for the answer!

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>