fields - values search command breaks dashboard when edit mode was activated

[mhornste]

Hi,

I'm running Splunk 6.4.0 with two customers.

When using the fields - values search command, the dashboard is not showing any data after I have clicked on Edit --> Panels. The spaces are automatically removed from fields - values --> fields-values resulting in the dashboard not showing any data any more (I can't attach a screenshot due to missing karma points). This is really annoying.

Maybe external links are allowed: http://imgur.com/a/4tGWt

I'm using the following search string:

index=otcs eventtype="SummaryTiming" | stats count values(FunctionAction), avg(ExecutionTime) by ContextUserName| fields - values(FunctionAction) | $user_avgexecution_sort$ | Rename ContextUserName as "Requesting User" | Rename count as "Number of Requests" | Rename avg(ExecutionTime) as "Average Execution Time"

Is this a bug of Splunk 6.4.x?

[mhornste]

Thanks, it worked!

[lguinn2 · Accepted solution]

No bug, but you are doing a few things that violate Splunk syntax and make your search run more slowly. Try this

index=otcs eventtype="SummaryTiming" 
| stats count avg(ExecutionTime) as avgTime by ContextUserName
| $user_avgexecution_sort$ 
| Rename ContextUserName as "Requesting User" 
| Rename count as "Number of Requests" | Rename avgTime as "Average Execution Time"

Sometimes Splunk does not like field names that have punctuation in them, some commands don't care. Therefore, I always use the "as" in stats to give those fields better (and easier to read) names. I created a field called avgTime in line 2 and used it in the final line.
Also, you created "values(FunctionAction)" in the stats command and then you never used it; you simply removed that result immediately afterward. I solved the problem by simply removing the initial calculation in the stats command.

[dbcase]

Also if you are going to use the above query in a dashboard make sure you add a preceeding $ and trailing $ to the user_avgexecution_sort

example

$$user_avgexecution_sort$$