Why does my search work in the Search App, but not as an inline search in a dashboard?

[edrivera3]

Hi

I have the following search that works correctly in the search app, but when I tried to include it as an inline search in the dashboard, it doesn't work.

index="job_event" | search error_number=05071 | eval "ACS Name"=acs_name | chart dedup_splitvals=t limit=100 useother=f count AS "# of Errors"  by "ACS Name" test_number format=$VAL$:::$AGG$ | sort limit=100 acs_name | fields - _span  | fields "ACS Name" *

I already checked that all extracted fields have permission to appear in all apps and users.
I also tried to change all quotation marks to & quot; but nothing changed.

[Flynt · Accepted solution]

You'll need to double escape the VAL and AGG as single $'s mean look for a token in a dashboard.

Try this

 index="job_event" | search error_number=05071 | eval "ACS Name"=acs_name | chart dedup_splitvals=t limit=100 useother=f count AS "# of Errors"  by "ACS Name" test_number format=$$VAL$$:::$$AGG$$ | sort limit=100 acs_name | fields - _span  | fields "ACS Name" *

In your dashboard.

[edrivera3]

It worked perfectly. Thank you.

[krwinters11]

I am also interested in an answer to this, as I have a similar question out that involves this issue and using the R Project app. http://answers.splunk.com/answers/229941/why-does-an-r-search-not-work-on-a-dashboard.html