Dashboards & Visualizations
Highlighted

Why is the token search returning "No Results Found"?

Path Finder

I am VERY new to Splunk. I'm attempting to create a dashboard where I can search an Application name and info about the application itself, the app servers it runs on, the databases that support the app, and the database servers that support the databases. I can get every panel to return results except for one.

index="databaseservertemp" Application=$appservicefield$ | join Database [search index="applicationdatabasetemp"] | table Application, Database, VM, InstanceName

When I remove the token search "Application=$appservicefield$ I can view results, however they do not pertain to the one application I'm searching. But when I include the token, I get a "No results found" message. Not sure why the token isn't working for this particular search.

0 Karma
Highlighted

Re: Why is the token search returning "No Results Found"?

Motivator

Is it possible your Application has a space in the value? If it does try changing your token to: Application=$appservicefield|s$

The |s means "wrap the value in quotes"

Highlighted

Re: Why is the token search returning "No Results Found"?

Path Finder

I actually figured out that I needed to switch my two indexes around. They were in the wrong places. Thank you for your assistance!

View solution in original post

0 Karma
Highlighted

Re: Why is the token search returning "No Results Found"?

Legend

@gbwilson, please go ahead and accept your own answer to mark this question as answered!

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.