Search Dashboard: "What to Search", what query is executed?

[mkelderm]

What kind of search query is executed on the Search Dashboard on "What to Search"?

In my dashboard (search-head), I only see "Waiting for data...."

Marc

[mkelderm · Accepted solution]

The solution is that my users, even the admin user, did not search the internal indexes by default. I needed to change the /local/authorize.conf file

[role_my_role]
srchIndexesAllowed = *;_*
srchIndexesDefault = _*;main

Thanks to Mart Mueller For giving me the thoughts on the solution

[martin_mueller]

By looking at your job monitor you can tell it's running this:

| metadata type=sourcetypes | search totalCount > 0

In essence, it loads a list of sourcetypes along with number of events, earliest and latest times. From that some post processing is applied to create the total number of events, the overall earliest time, and the overall latest time.

If you see nothing that likely means there is no data in any index searched by default for your role.

[martin_mueller]

Great.

For completeness' sake, mark this as answered and add your solution in another comment.

[mkelderm]

You triggered me on the issue, it is solved now

[martin_mueller]

There's your problem then, as long as you get no results the search page won't display any.

Metadata works through distributed search. As for why it doesn't seem to work for you is hard to say from here.

[mkelderm]

On de SH as admin: no results
On the SP as admin: results

[martin_mueller]

What happens when you run the query manually?

[mkelderm]

We do not see any data on this start page, while Splunk> is working fine. We can query etc. We are running on three servers, one search-head and 2 indexers.

[mkelderm]

Just de default search app, on Splunk 6.0:

http://myhost:8000/en-GB/app/search/search

[somesoni2]

What is the name app/dashboard you are using? [in url, portions after <>/en-US/app...]