Field missing in statistical table only, while present (with values) in search

[altink]

Dear all,

I have a dashboard table that does not display certain fields, which do have data - although not in every row - for the period searched.

The fields missing in the dashboard table are "group" and "rule".
when clicking the dashboard loop button - search in a new form - they do appear

Splunk version is 6.4.4.

the code is below:

<form>
  <label>Cisco FW Change 02</label>
  <search id="mc_unf_base">
    <query>index=net_firewall sourcetype=cisco:asa vendor_class=config user="*" command="*"</query>
    <earliest>$field_time.earliest$</earliest>
    <latest>$field_time.latest$</latest>
  </search>
  <fieldset submitButton="false">
    <input type="time" token="field_time">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search base="mc_unf_base">
          <query>| table _time, host, user, src, group, rule, severity_level, command, change_description     
                 | rename host AS Firewall, user as User, src as "Client IP", severity_level as Severity</query>
        </search>
        <option name="wrap">false</option>
        <option name="rowNumbers">true</option>
        <option name="drilldown">row</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">16</option>
      </table>
    </panel>
  </row>
</form>

best regards
Altin

[chrisyounger · Accepted solution]

Whenever you use a base search, you need to explicitly specify all fields that you need for later searches. So change your base search to this:

index=net_firewall sourcetype=cisco:asa vendor_class=config user="*" command="*"| fields _time, host, user, src, group, rule, severity_level, command, change_description

Secondly, using a base search without a summarising command is not ideal.

[altink]

thank you very much @chrisyoungerjds

best regards
Altin

[lakshman239]

Are you seeing them when you run your search in search window? Also, if there are more than 10 results, they would appear in the next page. hope you have checked that in the table results.

index=net_firewall sourcetype=cisco:asa vendor_class=config user="" command="" |fillnull value="N/A" group, rule | stats count by group, rule

[altink]

thank you,

but it is not a matter of pages. I do see them in search, but not in the statistical (dashboard) table