Dashboards & Visualizations
Highlighted

Why is my dashboard panel query only working in search mode(verbose)?

Explorer

Hi,

I've observed that my dashboard panel query(that has stats) has returned no records when I have stats in it. But, when I tried to run the same query in the search page by selecting verbose mode, it returned the result.

When I remove stats, it's working in the dashboard panel, but I need to count the records using stats per the requirement. Would like to check if there is a way to set verbose mode in a saved dashboard panel query

index=db_errors | dbxlookup lookup=QERROR|eval earlyDate=strftime("1541836800", "%Y-%m-%d")|  eval latestDate=strftime("1542268800", "%Y-%m-%d")| eval createdOn=strptime(CREATED_ON, "%Y-%m-%d %H:%M:%S")|eval createdOn1=strftime(createdOn, "%Y-%m-%d")|where createdOn1>=earlyDate AND createdOn1
0 Karma
Highlighted

Re: Why is my dashboard panel query only working in search mode(verbose)?

SplunkTrust
SplunkTrust

@sureshkrovi ,

If you trying stats on an extracted field, try explicitly mentioning the field list before your stats command.

index=db_errors | dbxlookup lookup=QERROR|eval earlyDate=strftime("1541836800", "%Y-%m-%d")
| eval latestDate=strftime("1542268800", "%Y-%m-%d")| eval createdOn=strptime(CREATED_ON, "%Y-%m-%d %H:%M:%S")
|eval createdOn1=strftime(createdOn, "%Y-%m-%d")|where createdOn1>=earlyDate AND createdOn1
|fields field1,field2,..fieldn |stats count by yourfieldlists

View solution in original post

0 Karma
Highlighted

Re: Why is my dashboard panel query only working in search mode(verbose)?

Explorer

what yourfieldlists refer here.Is it single field or do I need to mention all the fields.I tried this option but didn't work out.Note that ERRORCATEGORYNAME is the lookup output field
|eval createdOn1=strftime(createdOn, "%Y-%m-%d")|where createdOn1>=earlyDate AND createdOn1

0 Karma
Highlighted

Re: Why is my dashboard panel query only working in search mode(verbose)?

Explorer

One more observation is in search mode I see message "No data found yet" while query is running ,but in dashboard execution I didn't see this message.

Is anything we can suspect query execution time?e.g dasbhboard execution stops when query takes long time

0 Karma
Highlighted

Re: Why is my dashboard panel query only working in search mode(verbose)?

hi @sureshkrovi

Try like this .

Run your query in search page.click on visualization select which one you want.
just save it as dashboard ,If you want to add in exciting dashboard or new dashboard with your own choice.

0 Karma
Highlighted

Re: Why is my dashboard panel query only working in search mode(verbose)?

Explorer

Never mind,this is resolved.fields should be before lookup not at the end as the filter(where clause) is getting null created_date if we put fields at end that fails the query.

0 Karma