Dashboards & Visualizations

Why does my basic query work in search, but not in dashboard panel?

umdterps02
Path Finder

When I run this basic query in search, I get results:
alt text

When I run the same exact query in a dashboard panel, I get no results:

"Search did not return any events."

alt text

0 Karma
1 Solution

umdterps02
Path Finder

I figured out what the issue was, it appears that the CSV does not work with as an events table. I changed the table to a statistics table and it worked!

Thanks Everyone!

😃

View solution in original post

umdterps02
Path Finder

I figured out what the issue was, it appears that the CSV does not work with as an events table. I changed the table to a statistics table and it worked!

Thanks Everyone!

😃

briancronrath
Contributor

Are you running the search in the same app as the dashboard?

0 Karma

pruthvikrishnap
Contributor

Hi,
Instead of fields * try adding the fields to search, filed extraction may not happening in dashboard since it runs search in smart mode by default.

0 Karma

horsefez
Motivator

@umdterps02,

try out

yoursearch | table *

You chose the event view, you need the table command to display fields

0 Karma

umdterps02
Path Finder

It works in search, but not panel. I still get no results, I will have to check with admin for permissions. =(

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Did you check the permissions of your lookup?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You can easily check if its a permissions issue now. Go to Settings > Lookups and find your lookup table and identify what app it belongs to. Then go to your dashboard and verify its in the same app

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...