Why is my dashboard displaying N/A for a single value panel when using the base search id?

[bruceclarke]

I have a dashboard with one base search that drives a bunch of panels. To clean up the XML, make the dashboard easier to edit, and maybe make the dashboard a little performant, I am using a base search to drive these panels. The relevant XML is below:

<!-- We use this search to cache values for the searches below -->
<search id="exceptionInformation">
  <query>index=errors sourcetype=dotNetExceptions ExtractedMetadata.id=$exceptionId$ | head 1</query>
  <earliest>$timeRange.earliest$</earliest>
  <latest>$timeRange.latest$</latest>
</search>

...

<!-- This panel returns "N/A" but actually returns the correct results when I click the icon to run it in the search app -->
<panel>
  <title>Associated Request ID</title>
  <single>
    <search base="exceptionInformation">
      <query>search * | rename ExtractedMetadata.requestId as RequestId | table RequestId</query>
      <earliest>$timeRange.earliest$</earliest>
      <latest>$timeRange.latest$</latest>
    </search>
  </single>
</panel>

...

<!-- This panel works just fine. It returns the same results regardless of if I'm looking at it in the dashboard or in the search app -->
<panel>
  <title>Exception Inner Stack Trace</title>
  <table>
    <search base="exceptionInformation">
      <query>search * | eval stackTrace=coalesce('CanonicalException.InnerException.StackTrace','CanonicalException.StackTrace') | eval stackTrace=replace(stackTrace," at ", " <NEWLINE> at ") | makemv delim=" <NEWLINE> " stackTrace | rename stackTrace as "Inner Stack Trace" | table "Inner Stack Trace"</query>
      <earliest>$timeRange.earliest$</earliest>
      <latest>$timeRange.latest$</latest>
    </search>
    <option name="linkView">search</option>
    <option name="wrap">true</option>
    <option name="rowNumbers">false</option>
    <option name="dataOverlayMode">none</option>
    <option name="list.drilldown">full</option>
    <option name="list.wrap">1</option>
    <option name="maxLines">5</option>
    <option name="raw.drilldown">full</option>
    <option name="table.drilldown">all</option>
    <option name="table.wrap">1</option>
    <option name="type">list</option>
    <option name="drilldown">none</option>
    <option name="count">10</option>
  </table>
</panel>

As I mentioned in the comments above, the base search works fine for the last "table" panel, but doesn't work correctly for the "single" panel. Is this a bug in Splunk? Has anybody seen this behavior before? Any help/workarounds would be greatly appreciated.

Thanks!

[woodcock]

Official SplunkFu (http://image.slidesharecdn.com/splunkninjas-newfeaturespivotandsearchdojo-150312174437-conversion-ga...) says to do the rename last so try this:

   <query>table RequestId | rename ExtractedMetadata.requestId AS RequestId</query>

[somesoni2 · Accepted solution]

Change your base search query with this and test

index=errors sourcetype=dotNetExceptions ExtractedMetadata.id=$exceptionId$ | head 1 | table *

[woodcock]

The XML-based dashboards require ampersand, less-than, and greater-than to be URL-encoded so you need to change:

<NEWLINE>

to this:

<NEWLINE>

[bruceclarke]

I should have simplified the search example, but rest assured the searches are URL-encoded properly. Moreover, that is the panel that actually works exactly as I would expect. It's the single panel that I'm seeing issues with

[woodcock]

Remove the search * | strings from your `` lines.

[bruceclarke]

Unfortunately, I still get the same results, "N/A" is displayed for the single panels. Nice to know that the search * command isn't needed though.