Dashboards & Visualizations

Why Simple XML dashboard using saved report is not rendering as it searches with panels saying "Waiting for data"?

jdunlea
Contributor

I have a simple xml dashboard using two saved reports utilizing the stats command.

When I run either of these pretty simplistic reports individually in the search bar, the results start to pour onto the screen while the job continues to progress through the rest of the search.

However, when I have a simple xml dashboard that is driving two simple panels from these two saved reports, the panel seemingly does not render anything while the search job is running. Each panel says "Waiting for data".

However, when I replace the reference of the saved report with the actual search string, therefor running the search inline, the panels start to render data on the fly as the search is continuing to completion.

What is wrong here? I need to refernce the actual saved report as this report has been configured for report acceleration and I want the dashboard to use the accelerated summaries.

Anyone have ideas?! Here is a sample of the XML that is causing issues.

<dashboard>
  <label>MIP - Dashboard Name</label>
  <row>
    <panel>
      <table>
        <title>External Data Flow - Top Senders</title>
               <searchName>MIP Search 1</searchName>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>External Data Flow by Category</title>
        <searchName>MIP Search 2</searchName>
      </table>
    </panel>
  </row>
</dashboard>

The XML that allows the panel to render results while the rest of the search completes is as follows. It is simply replacing search 1 with the direct SPL of that search:

<dashboard>
   <label>MIP - Dashboard Name</label>
   <row>
     <panel>
       <table>
         <title>External Data Flow - Top Senders</title>
                <searchString>index=myindex foo AND bar| stats count by field1 field2 field3</searchString>
       </table>
     </panel>
   </row>
   <row>
     <panel>
       <table>
         <title>External Data Flow by Category</title>
         <searchName>MIP Search 2</searchName>
       </table>
     </panel>
   </row>
 </dashboard>
0 Karma
1 Solution

somesoni2
Revered Legend

Intead of below syntax

 <searchName>MIP Search 1</searchName>

try this

 <searchString>| savedsearch "MIP Search 1"</searchString>

View solution in original post

0 Karma

ngatchasandra
Builder

Hi,

you can have a problem with your spelling savedSearch name! Then verify if you call your report exactly or verify if you give permissions for all apps !

See my example! I have two savedSearch who is name testtsplunkd and License Usage Data Cube, my XML code that folllow shows the results in the two panels:

<dashboard>
   <label>MIP - Dashboard Name</label>
   <row>
     <panel>
       <table>
         <title>External Data Flow - Top Senders</title>
                <searchName>testtsplunkd</searchName>
       </table>
     </panel>
   </row>
   <row>
     <panel>
       <table>
         <title>External Data Flow by Category</title>
         <searchName>License Usage Data Cube</searchName>
       </table>
     </panel>
   </row>
 </dashboard>
0 Karma

somesoni2
Revered Legend

Intead of below syntax

 <searchName>MIP Search 1</searchName>

try this

 <searchString>| savedsearch "MIP Search 1"</searchString>
0 Karma

jdunlea
Contributor

This worked. However it doesnt explain the previous behavior?

Either way I have converted all panels to inline searches so that I can use filtering and form inputs. But thank you for the answer!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...