Dashboards & Visualizations

search index="name" shows 0 results, but index="name" does

mcarlson
Explorer

Hey Answers,

I created a new index called bacula.

When I search for:
"search index=bacula"

0 results show up. However, when I search for:
"index=bacula"

I get the data as expected.

The reason this matters is when I add my query to a dashboard, the dashboard automatically changes the query from "sourcetype=bacula..." to "search sourcetype=bacula..." and nothing shows up.

This is all within a app I created, and the index is associated with that app. I also modified the Roles (user and admin so far) to include the bacula index. Is there some addtional permission issues I have missed?

Thanks!

Mike

Tags (2)
0 Karma

hexx
Splunk Employee
Splunk Employee

Where do you see the dashboard changing the query? Could you show us what lines appear in $SPLUNK_HOME/var/log/splunk/searches.log when you load the dashboard?

mcarlson
Explorer

Right, and I am not including the word "search", Splunk is injecting "search" into the query when I add a saved search to a dashboard.

0 Karma

atreece
Path Finder

Entering anything in the search field uses the search command. Executing a search with "search" in it (except when required for a subsearch) is asking splunk to look in that index for the word "search" in the data. If any of your events have the word "search" in them somewhere, they would show up in this case.

0 Karma

dwaddle
SplunkTrust
SplunkTrust

search is the search command to search, and should be implied but not included as part of the search. (For example, in subsearches you need to specify search as the command.) This behavior may be a bug. If you have enterprise support, I would suggest a support case.

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.