Dashboards & Visualizations

Why does my basic query work in search, but not in dashboard panel?

umdterps02
Path Finder

When I run this basic query in search, I get results:
alt text

When I run the same exact query in a dashboard panel, I get no results:

"Search did not return any events."

alt text

0 Karma
1 Solution

umdterps02
Path Finder

I figured out what the issue was, it appears that the CSV does not work with as an events table. I changed the table to a statistics table and it worked!

Thanks Everyone!

😃

View solution in original post

umdterps02
Path Finder

I figured out what the issue was, it appears that the CSV does not work with as an events table. I changed the table to a statistics table and it worked!

Thanks Everyone!

😃

briancronrath
Contributor

Are you running the search in the same app as the dashboard?

0 Karma

pruthvikrishnap
Contributor

Hi,
Instead of fields * try adding the fields to search, filed extraction may not happening in dashboard since it runs search in smart mode by default.

0 Karma

horsefez
Motivator

@umdterps02,

try out

yoursearch | table *

You chose the event view, you need the table command to display fields

0 Karma

umdterps02
Path Finder

It works in search, but not panel. I still get no results, I will have to check with admin for permissions. =(

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Did you check the permissions of your lookup?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You can easily check if its a permissions issue now. Go to Settings > Lookups and find your lookup table and identify what app it belongs to. Then go to your dashboard and verify its in the same app

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...