Dashboards & Visualizations

Why does my basic query work in search, but not in dashboard panel?

umdterps02
Path Finder

When I run this basic query in search, I get results:
alt text

When I run the same exact query in a dashboard panel, I get no results:

"Search did not return any events."

alt text

0 Karma
1 Solution

umdterps02
Path Finder

I figured out what the issue was, it appears that the CSV does not work with as an events table. I changed the table to a statistics table and it worked!

Thanks Everyone!

😃

View solution in original post

umdterps02
Path Finder

I figured out what the issue was, it appears that the CSV does not work with as an events table. I changed the table to a statistics table and it worked!

Thanks Everyone!

😃

briancronrath
Contributor

Are you running the search in the same app as the dashboard?

0 Karma

pruthvikrishnap
Contributor

Hi,
Instead of fields * try adding the fields to search, filed extraction may not happening in dashboard since it runs search in smart mode by default.

0 Karma

horsefez
Motivator

@umdterps02,

try out

yoursearch | table *

You chose the event view, you need the table command to display fields

0 Karma

umdterps02
Path Finder

It works in search, but not panel. I still get no results, I will have to check with admin for permissions. =(

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Did you check the permissions of your lookup?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You can easily check if its a permissions issue now. Go to Settings > Lookups and find your lookup table and identify what app it belongs to. Then go to your dashboard and verify its in the same app

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...