Splunk Search

One Dashboard panel is not showing any results

vjsplunk
Loves-to-Learn Everything

One of my dashboard panel is not showing any results. But when I run the search manually it is giving results. Out of 8 panels only one panel is having the issue. I am not using base searches.

Labels (1)
0 Karma

dural_yyz
Motivator

Ugly and stupid but I've seen this before and didn't find a nice answer. Try this...

'initial search spl'
| fields *
'remainder of search as written'
0 Karma

vjsplunk
Loves-to-Learn Everything

Found the issue. It was because I am not using null values before the transforming command

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@vjsplunk- Glad you found solution to your problem. Please accept your own answer by clicking "Accept as Answer" so in future community users get benefited from this.

 

Community Moderator,

Vatsal Jagani

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

OK so there is probably something different about the search which is not working - perhaps if you shared that with us we might be able to spot something, but at the moment this knowledge is unavailable to us.

0 Karma

vjsplunk
Loves-to-Learn Everything

Yes. If I open the panel from "Open in Search" it is giving the results.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vjsplunk ,

are you using a post process search?

if yes, you have to declare all the fields that you use in the panels, using fields.

Ciao.

Giuseppe

0 Karma

vjsplunk
Loves-to-Learn Everything

I am using an xyseries command after the filtering commands it is not giving any results.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vjsplunk ,

could you share your code?

Ciao.

Giuseppe

0 Karma

vjsplunk
Loves-to-Learn Everything

index="test" source="test2"  "REPORT RequestId: "| eval Latency = rex(***)
|xyseries avg(Latency) as avg_Latency over _time by useragent

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The xyseries command doesn't work like that

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xyseries

Try replacing it with the chart command

|chart avg(fusionapiLatency) as avg_fusionapiLatency over _time by useragent
0 Karma

vjsplunk
Loves-to-Learn Everything

Chart also not giving the results

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share some sample anonymised events in a code block so we can see what you are dealing with?

0 Karma

vjsplunk
Loves-to-Learn Everything

Yes. If I open the panel from "Open in Search" it is giving the results.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@vjsplunk- If that is the case and you said you are not using base-searches then the only issue could be browser caching or cookie issue. Try incognito window.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@vjsplunk- Is your Panel and Direct search using the same time-range??

  • Try increasing the time-range on the dashboard maybe!

 

Also, what happens when you open the panel in "Open in Search" from the bottom right of the panel? Do you see the results or no?

 

I hope this helps!!! Kindly upvote if it does!!!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...