- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ES - Why is Network Dashboard Not Populating?
code_assassin
Explorer
05-02-2023
12:09 PM
Hello Splunkies,
Having some issues with getting ES dashboards to populate...
Query for Network Traffic Dashboard titled, "Traffic Search" :
| tstats `summariesonly` max(_time) as _time,values(All_Traffic.action) as action,values(All_Traffic.src_port) as src_port,count from datamodel=Network_Traffic.All_Traffic where * $action_dm$ $src_dm$ $dest_dm$ $transport_dm$ $dest_port_dm$ by All_Traffic.src,All_Traffic.dest,All_Traffic.transport,All_Traffic.dest_port
| `drop_dm_object_name("All_Traffic")`
| sort - count
| fields _time,action,src,src_port,dest,transport,dest_port,count
Error I get when launching: Error in 'TsidxStats': WHERE clause is not an exact query.
Thanks in advance for the help!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
meetmshah
Builder
07-20-2023
04:29 AM
Hello @code_assassin If you are manually running this, it will not work as there are tokens mentioned in the search. A good approach would be to click on "Submit" button and validate if it's populating the results or not. If there are no results, you will need to validate if Data Model is having the values or not.
Perhaps, is this still an issue for you?
Please accept the solution and hit Karma, if this helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
code_assassin
Explorer
05-03-2023
04:17 AM
I tried to specify an index based off a similar question however no dice.
