This is basically what our dashboard XML looks like. I'm starting to wonder if the problem is related to the rundeck_job_id field being a rex _raw field in the query? We recently had to change the search since logging changed; rundeck_job_id was not previously being pulled out with a rex but was a pre-existing field. <dashboard theme="light">
<label>Deploy Job Status</label>
<description>Status of Deploy Full Environment (JSON) jobs in Rundeck</description>
<row>
<panel>
<title>Last 24 Hours</title>
<table>
<title>Click on cell to go to job in rundeck</title>
<search>
<query>index=* sourcetype=rundeck* source=*execution* "Deploy Full"| eval latest_update=strftime(_time, "%d %b %H:%M") |rex field=_raw "\[(?<rundeck_job_id>\d{8,})" |table environment,deploy_job_status,latest_update,json | dedup environment sortby -latest_update</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="deploy_job_status">
<colorPalette type="map">{"failed":#DC4E41,"running":#F8BE34,"succeeded":#4FA484}</colorPalette>
</format>
<format type="color" field="deploy_job_status">
<colorPalette type="map">{"failed":#DC4E41,"running":#F8BE34,"succeeded":#4FA484}</colorPalette>
</format>
<format type="color" field="deploy_job_status">
<colorPalette type="map">{"failed":#DC4E41,"running":#F8BE34,"succeeded":#4FA484}</colorPalette>
</format>
<format type="color" field="deploy_job_status">
<colorPalette type="map">{"failed":#DC4E41,"running":#F8BE34,"succeeded":#4FA484}</colorPalette>
</format>
<drilldown>
<link target="_blank">https://rundeck.server/project/Project_Name/execution/show/$row.rundeck_job_id$</link>
</drilldown>
</table>
</panel>
</row>
</dashboard>
... View more