Dashboards & Visualizations

Why does my basic query work in search, but not in dashboard panel?

umdterps02
Path Finder

When I run this basic query in search, I get results:
alt text

When I run the same exact query in a dashboard panel, I get no results:

"Search did not return any events."

alt text

0 Karma
1 Solution

umdterps02
Path Finder

I figured out what the issue was, it appears that the CSV does not work with as an events table. I changed the table to a statistics table and it worked!

Thanks Everyone!

😃

View solution in original post

umdterps02
Path Finder

I figured out what the issue was, it appears that the CSV does not work with as an events table. I changed the table to a statistics table and it worked!

Thanks Everyone!

😃

briancronrath
Contributor

Are you running the search in the same app as the dashboard?

0 Karma

pruthvikrishnap
Contributor

Hi,
Instead of fields * try adding the fields to search, filed extraction may not happening in dashboard since it runs search in smart mode by default.

0 Karma

horsefez
Motivator

@umdterps02,

try out

yoursearch | table *

You chose the event view, you need the table command to display fields

0 Karma

umdterps02
Path Finder

It works in search, but not panel. I still get no results, I will have to check with admin for permissions. =(

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Did you check the permissions of your lookup?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You can easily check if its a permissions issue now. Go to Settings > Lookups and find your lookup table and identify what app it belongs to. Then go to your dashboard and verify its in the same app

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...