Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Why is the token search returning "No Results Foun...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am VERY new to Splunk. I'm attempting to create a dashboard where I can search an Application name and info about the application itself, the app servers it runs on, the databases that support the app, and the database servers that support the databases. I can get every panel to return results except for one.
index="databaseserver_temp" Application=$appservicefield$ | join Database [search index="applicationdatabase_temp"] | table Application, Database, VM, InstanceName
When I remove the token search "Application=$appservicefield$ I can view results, however they do not pertain to the one application I'm searching. But when I include the token, I get a "No results found" message. Not sure why the token isn't working for this particular search.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I actually figured out that I needed to switch my two indexes around. They were in the wrong places. Thank you for your assistance!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I actually figured out that I needed to switch my two indexes around. They were in the wrong places. Thank you for your assistance!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@gbwilson, please go ahead and accept your own answer to mark this question as answered!
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is it possible your Application has a space in the value? If it does try changing your token to: Application=$appservicefield|s$
The |s means "wrap the value in quotes"
Index This | What’s a riddle wrapped in an enigma?
BORE at .conf25
OpenTelemetry for Legacy Apps? Yes, You Can!
