Why does Dashboard Classic not return result even though "Open in search" does?

[yuanliu]

Here is a really simple dashboard:

<form version="1.1" theme="light">
  <label>Simple input</label>
  <fieldset submitButton="false">
    <input type="text" token="text_tok" searchWhenChanged="true">
      <label></label>
      <default></default>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <search>
          <query>| makeresults
| eval INPUT = if(len("$text_tok$") &gt;0, "$text_tok$", "(none)")</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="list.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </event>
    </panel>
  </row>
</form>

Its function is really simple: When nothing is entered into the text input, display something like

INPUT	_time
(none)	2024-09-28 17:33:54

Indeed, when I click the magnifying glass ("Open in search"), that's what I get

If any string is entered, that string will be displayed.  For example, if a single letter "a" is entered, it should display

INPUT	_time
a	2024-09-28 17:31:31

Just as well, "Open in search" gives this output

However, no matter what is entered or not entered, the dashboard panel always says "Search did not return any events."

 

Test is done in Splunk 9.3.0. 

[yuanliu · Accepted solution]

The problem is in visualization type <event />.  Even though makeresults is a generative command, there is no real event.  Switch to <table /> visualization and the dashboard functions as expected.

<form version="1.1" theme="light">
  <label>Simple input</label>
  <fieldset submitButton="false">
    <input type="text" token="text_tok" searchWhenChanged="true">
      <label></label>
      <default></default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval INPUT = if(len("$text_tok$") &gt;0, "$text_tok$", "(none)")</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>