Dashboards & Visualizations

search index="name" shows 0 results, but index="name" does

mcarlson
Explorer

Hey Answers,

I created a new index called bacula.

When I search for:
"search index=bacula"

0 results show up. However, when I search for:
"index=bacula"

I get the data as expected.

The reason this matters is when I add my query to a dashboard, the dashboard automatically changes the query from "sourcetype=bacula..." to "search sourcetype=bacula..." and nothing shows up.

This is all within a app I created, and the index is associated with that app. I also modified the Roles (user and admin so far) to include the bacula index. Is there some addtional permission issues I have missed?

Thanks!

Mike

Tags (2)
0 Karma

hexx
Splunk Employee
Splunk Employee

Where do you see the dashboard changing the query? Could you show us what lines appear in $SPLUNK_HOME/var/log/splunk/searches.log when you load the dashboard?

mcarlson
Explorer

Right, and I am not including the word "search", Splunk is injecting "search" into the query when I add a saved search to a dashboard.

0 Karma

atreece
Path Finder

Entering anything in the search field uses the search command. Executing a search with "search" in it (except when required for a subsearch) is asking splunk to look in that index for the word "search" in the data. If any of your events have the word "search" in them somewhere, they would show up in this case.

0 Karma

dwaddle
SplunkTrust
SplunkTrust

search is the search command to search, and should be implied but not included as part of the search. (For example, in subsearches you need to specify search as the command.) This behavior may be a bug. If you have enterprise support, I would suggest a support case.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...