Hi,
I've been using Splunk 6.4 to create a set dashboard panels. I've come a across an issue where I have the following query:
index=index Category="$Category_1$" | eval eval_1=substr(field_1,1,7) | top limit=$TopNo_1$ eval_1 | fields - percent
This query works perfectly when I first write and save it to a panel. However, once I leave the dashboard and come back into it, the panel no longer returns anything because the query has been changed to this:
index=index Category="$Category_1$" | eval eval_1=substr(field_1,1,7) | top limit=$TopNo_1$ eval_1 | fields-percent
The spaces in the fields section get removed. Instead of removing the percent field, it tries to show only the -percent field, which does not exist. Now it doesn't seem to matter what I try with that fields, if I try "percent", or try moving that segment to the middle of the query. Both of these tweaks work at first, but ultimately the spaces get removed.
Sometimes this query does stay the way I need it to. However, on the same dashboard, I have a second panel which faces the same problem. What then becomes the case is that one panel will be fine, but the other is broken, and when I fix the second panel, the first panel breaks, and then vice versa if I fix the first panel.
I have tried going directly into the source and making changes there, but the same issue occurs.
So my question is, has anyone ever encountered this problem before? Can anyone suggest a work around?
Thanks.
... View more