Dashboards & Visualizations

makeresult Work in normal Search app but not in my Dashboard

mklhs
Path Finder

Hello,

i want to build a dashboard with different panels to Analyse some Alarms.
At the Top i have 2 Input fields field1(text input) and field2(dropdown for status)
I want to habe a panel or an hidden query where i build with | makeresult some Values and write them into my index. Like an Kommentary Funktion for Analysis.
My Problem is now that if i use this query in normal Search app:

| makeresults
| eval event_hash=123
| eval kommentar=abc
| eval wann = now()
| table event_hast kommentar wann

it works perfectly....

But if im going to Save this as a dashboard Panel and look at my Dashboard, it say that no Results get Reflected.

Anyone know This issue?

Thanks for your Help

0 Karma

woodcock
Esteemed Legend

As I suspected, you saved it with the Events visualization instead of the Statistics. Change this:

<event>
...
</event>

To this:

<table>
...
</table>

mklhs
Path Finder

Thank you for your Time
This is the Part from my Dashboard, if you need more Tell me
My Dashboard:

<form>
  <label>Analyse Dashboard</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="text" token="analyse_result" searchWhenChanged="true">
      <label>Analyse Ergebnis</label>
    </input>
    <input type="dropdown" token="alarm_status">
      <label>Alarm Status ändern</label>
      <choice value="Open">Offen</choice>
      <choice value="Work">In Arbeit</choice>
      <choice value="Closed">Geschlossen</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <search>
          <query>| makeresults 
| eval event_hash=123 
| eval alarm_phase = "Open" 
| eval wann = now() 
| eval kommentar="bla" 
| table event_hash alarm_phase wann kommentar</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="list.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </event>
    </panel>
  </row>
</form>
0 Karma

woodcock
Esteemed Legend

Post your dashboard XML so we can all play.

0 Karma

mklhs
Path Finder

Thank you for your Time
This is the Part from my Dashboard, if you need more Tell me
My Dashboard:

Analyse Dashboard

 <input type="text" token="analyse_result" searchWhenChanged="true">
      <label>Analyse Ergebnis</label>
    </input>
    <input type="dropdown" token="alarm_status">
      <label>Alarm Status ändern</label>
      <choice value="Open">Offen</choice>
      <choice value="Work">In Arbeit</choice>
      <choice value="Closed">Geschlossen</choice>
    </input>


    <panel>
      <event>
        <search>
          <query>| makeresults 
| eval event_hash=123 
| eval alarm_phase = "Open" 
| eval wann = now() 
| eval kommentar="bla" 
| table event_hash alarm_phase wann kommentar
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="list.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </event>
    </panel>
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...