Good morning,
I've noticed a strange phenomenon with Splunk Enterprise 7.1.4 base searches and I wanted to see whether anyone else has noticed it too. Here is what I've done:
Now for the weird part. The dashboard doubles the results in the panel! If I open the panel in search through the magnifying glass icon it shows the correct, non-doubled value. After further analysis I've found that there are two ways to get the panel working properly:
Is this a bug in Splunk? Before anyone asks, no there are no duplicate events in the index.
Regards,
Andrew
open a support case and ask Splunk.
Please, take a look at this question about populating dropdown items https://answers.splunk.com/answers/145911/how-to-populate-dropdown-input-with-ids-from-search.html
Show some events and show the XML, so that we can try to reproduce it.
@woodcock I've tried to isolate and reproduce the issue in the search app but I cannot... I asked the question to see whether there was a known issue. I wonder if it is permission related or whether there is some config file that causes this phenomenon.