Dashboards & Visualizations

Why Simple XML dashboard using saved report is not rendering as it searches with panels saying "Waiting for data"?

jdunlea
Contributor

I have a simple xml dashboard using two saved reports utilizing the stats command.

When I run either of these pretty simplistic reports individually in the search bar, the results start to pour onto the screen while the job continues to progress through the rest of the search.

However, when I have a simple xml dashboard that is driving two simple panels from these two saved reports, the panel seemingly does not render anything while the search job is running. Each panel says "Waiting for data".

However, when I replace the reference of the saved report with the actual search string, therefor running the search inline, the panels start to render data on the fly as the search is continuing to completion.

What is wrong here? I need to refernce the actual saved report as this report has been configured for report acceleration and I want the dashboard to use the accelerated summaries.

Anyone have ideas?! Here is a sample of the XML that is causing issues.

<dashboard>
  <label>MIP - Dashboard Name</label>
  <row>
    <panel>
      <table>
        <title>External Data Flow - Top Senders</title>
               <searchName>MIP Search 1</searchName>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>External Data Flow by Category</title>
        <searchName>MIP Search 2</searchName>
      </table>
    </panel>
  </row>
</dashboard>

The XML that allows the panel to render results while the rest of the search completes is as follows. It is simply replacing search 1 with the direct SPL of that search:

<dashboard>
   <label>MIP - Dashboard Name</label>
   <row>
     <panel>
       <table>
         <title>External Data Flow - Top Senders</title>
                <searchString>index=myindex foo AND bar| stats count by field1 field2 field3</searchString>
       </table>
     </panel>
   </row>
   <row>
     <panel>
       <table>
         <title>External Data Flow by Category</title>
         <searchName>MIP Search 2</searchName>
       </table>
     </panel>
   </row>
 </dashboard>
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Intead of below syntax

 <searchName>MIP Search 1</searchName>

try this

 <searchString>| savedsearch "MIP Search 1"</searchString>

View solution in original post

0 Karma

ngatchasandra
Builder

Hi,

you can have a problem with your spelling savedSearch name! Then verify if you call your report exactly or verify if you give permissions for all apps !

See my example! I have two savedSearch who is name testtsplunkd and License Usage Data Cube, my XML code that folllow shows the results in the two panels:

<dashboard>
   <label>MIP - Dashboard Name</label>
   <row>
     <panel>
       <table>
         <title>External Data Flow - Top Senders</title>
                <searchName>testtsplunkd</searchName>
       </table>
     </panel>
   </row>
   <row>
     <panel>
       <table>
         <title>External Data Flow by Category</title>
         <searchName>License Usage Data Cube</searchName>
       </table>
     </panel>
   </row>
 </dashboard>
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Intead of below syntax

 <searchName>MIP Search 1</searchName>

try this

 <searchString>| savedsearch "MIP Search 1"</searchString>
0 Karma

jdunlea
Contributor

This worked. However it doesnt explain the previous behavior?

Either way I have converted all panels to inline searches so that I can use filtering and form inputs. But thank you for the answer!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...