Splunk Search

Why is the table in dashboard reporting "No results found" when there are in fact results found?

simpkins1958
Contributor

We have a table in a dashboard that shows "No results found." when in fact there are results for the search based on the search inspector and when open in search for the panel is executed. Any hints on what might be causing this issue? A Splunk bug? We are running Splunk 7.0.0.

alt text

0 Karma

elliotproebstel
Champion

I suspect your dashboard is configured to display an events table, but you are returning a stats table. Can you edit the dashboard and ensure this is set as a stats table?

elliotproebstel
Champion

Hey @simpkins1958 - did this turn out to be the issue, or do you still need help?

0 Karma

micahkemp
Champion

This is probably more likely than my answer. 🙂

0 Karma

micahkemp
Champion

I wonder if you're running into a known issue, SPL-142964.

This recent answers post discusses something similar.

This issue was fixed in 6.6.4. Are you running a version lower than this?

0 Karma

simpkins1958
Contributor

We are running 7.0.0.

0 Karma

micahkemp
Champion

I'm also seeing it was fixed in 7.0.1, so you may still be affected. Look in your search.log for lines like:

08-30-2017 12:58:47.035 ERROR Timeliner - Ignored 2 events because they were after the commit time (0).
08-30-2017 12:58:38.909 WARN SearchResultCollator - Collector X produced chunk with startTime 1503348584.000000 when our cursor time was already 0.000000, time ordering has failed!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...