Splunk query doesnt show results in dashboard panel but displays results when using search tab

[pk0024]

Hi, I am having difficulty in showing up results from splunk query in dashboard panel where it always says 'No results found.' however the Query displays results when searched directly from search tab or even clicking on 'open in search' magnifier icon button from dashboard panel.

I am trying to display top 10 errors in pie chart based on dropdowns(environment, time), In the base query I have search index and in the actual dashboard panel query I have environment that is driven from dropdown value and I also time dropdown.  

<form>
<label>Label</label>
<search id="base">
<query>index="app_3537255" </query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
</search>
<fieldset submitButton="false" autoRun="true">
<input type="time" token="time_token" searchWhenChanged="true">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="APIG_ENV" searchWhenChanged="true">
<label>Environment</label>
<choice value="*">All</choice>
<search>
<query>index="app_3537255" | table host | sort host | dedup host</query>
<earliest>-7d@h</earliest>
<latest>now</latest>
</search>
<default>*</default>
<initialValue>*</initialValue>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
</input>
</fieldset>
<row>
    <panel>
      <title>Top 10 Common Errors</title>
      <chart>
        <search base="base">
          <query>| search host=$APIG_ENV$ eventtype="nix_errors" OR eventtype="err0r"  | rex field=_raw "Error\s(?P&lt;ErrorString&gt;.*)" | eval ErrorString = "Error " + ErrorString | stats count(ErrorString) AS TotalCount BY ErrorString|sort -TotalCount | head 10</query>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.abbreviation">none</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.abbreviation">none</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.abbreviation">none</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">pie</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.mode">standard</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.lineWidth">2</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
      </chart>
    </panel>
  </row>
</form>

any reason why this is not working in dashboard panel? any pointers would be appreciated.

[PradReddy · Accepted solution]

Hi pk0024,

It seems your base search is a non-transforming search, you must explicitly state in the base search what fields will be used in the post-process search using the | fields command.

As per splunk best practices around base search usage can be found here -  https://docs.splunk.com/Documentation/Splunk/8.2.2/Viz/Savedsearches  (adjust version that suits your environment) 

On another note 
- In regards to eventtype is that "0" expected or is it a typo mistake 

eventtype="err0r"

------

An upvote would be appreciated and Accept Solution if it helps!

[pk0024]

Thanks, After specifying the fields i can see dashboard being populated with results. Yes it has 0 in eventtype.