Hi, I am having difficulty in showing up results from splunk query in dashboard panel where it always says 'No results found.' however the Query displays results when searched directly from search tab or even clicking on 'open in search' magnifier icon button from dashboard panel. I am trying to display top 10 errors in pie chart based on dropdowns(environment, time), In the base query I have search index and in the actual dashboard panel query I have environment that is driven from dropdown value and I also time dropdown. <form>
<label>Label</label>
<search id="base">
<query>index="app_3537255" </query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
</search>
<fieldset submitButton="false" autoRun="true">
<input type="time" token="time_token" searchWhenChanged="true">
<label>Time</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="APIG_ENV" searchWhenChanged="true">
<label>Environment</label>
<choice value="*">All</choice>
<search>
<query>index="app_3537255" | table host | sort host | dedup host</query>
<earliest>-7d@h</earliest>
<latest>now</latest>
</search>
<default>*</default>
<initialValue>*</initialValue>
<fieldForLabel>host</fieldForLabel>
<fieldForValue>host</fieldForValue>
</input>
</fieldset>
<row>
<panel>
<title>Top 10 Common Errors</title>
<chart>
<search base="base">
<query>| search host=$APIG_ENV$ eventtype="nix_errors" OR eventtype="err0r" | rex field=_raw "Error\s(?P<ErrorString>.*)" | eval ErrorString = "Error " + ErrorString | stats count(ErrorString) AS TotalCount BY ErrorString|sort -TotalCount | head 10</query>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">pie</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">none</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">none</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">right</option>
<option name="charting.lineWidth">2</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
</chart>
</panel>
</row>
</form> any reason why this is not working in dashboard panel? any pointers would be appreciated.
... View more
