Splunk Search

Why does my search work in the Search App, but not as an inline search in a dashboard?

edrivera3
Builder

Hi

I have the following search that works correctly in the search app, but when I tried to include it as an inline search in the dashboard, it doesn't work.

index="job_event" | search error_number=05071 | eval "ACS Name"=acs_name | chart dedup_splitvals=t limit=100 useother=f count AS "# of Errors"  by "ACS Name" test_number format=$VAL$:::$AGG$ | sort limit=100 acs_name | fields - _span  | fields "ACS Name" *

I already checked that all extracted fields have permission to appear in all apps and users.
I also tried to change all quotation marks to & quot; but nothing changed.

Tags (3)
1 Solution

Flynt
Splunk Employee
Splunk Employee

You'll need to double escape the VAL and AGG as single $'s mean look for a token in a dashboard.

Try this

 index="job_event" | search error_number=05071 | eval "ACS Name"=acs_name | chart dedup_splitvals=t limit=100 useother=f count AS "# of Errors"  by "ACS Name" test_number format=$$VAL$$:::$$AGG$$ | sort limit=100 acs_name | fields - _span  | fields "ACS Name" *

In your dashboard.

View solution in original post

Flynt
Splunk Employee
Splunk Employee

You'll need to double escape the VAL and AGG as single $'s mean look for a token in a dashboard.

Try this

 index="job_event" | search error_number=05071 | eval "ACS Name"=acs_name | chart dedup_splitvals=t limit=100 useother=f count AS "# of Errors"  by "ACS Name" test_number format=$$VAL$$:::$$AGG$$ | sort limit=100 acs_name | fields - _span  | fields "ACS Name" *

In your dashboard.

edrivera3
Builder

It worked perfectly. Thank you.

0 Karma

krwinters11
Path Finder

I am also interested in an answer to this, as I have a similar question out that involves this issue and using the R Project app. http://answers.splunk.com/answers/229941/why-does-an-r-search-not-work-on-a-dashboard.html

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...