Why does the dashboard show no data, but opening the saved search or running it manually produces results?

[jvishwak]

I'm not able to see saved search data in a dashboard, but when I open the the same search and manually execute the search, it's giving proper results. When I open the saved search, then it also shows the results.

Permissions and all are looking fine.

Any suggestions why this could be happening?

[renjith_nair]

It's possible that you have search time field extraction and in that case you have to specify the fields explicitly in the search since dashboards runs in fastmode.

Another possibility is to add "" to your field names. Sometimes strings have to be quoted for splunk to identify , especially in dashboard xmls

[phadnett_splunk]

Are there any messages in the UI that might help us determine why? Does this happen consistently, even during different times of the day?

[sundareshr]

Check job inspector for clues.