Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About kylbarne
kylbarne
New Member
Member since:
06-02-2017
06-05-2020
Community Statistics
| Posts | 9 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 06-02-2017 |
Activity Feed
- Posted Re: Why does the search on my dashboard show "No result found" and fails to load the panel, but opening in search is successful? on Splunk Search. 06-02-2017 03:12 PM
- Posted Re: Why does the search on my dashboard show "No result found" and fails to load the panel, but opening in search is successful? on Splunk Search. 06-02-2017 02:57 PM
- Posted Re: Why does the search on my dashboard show "No result found" and fails to load the panel, but opening in search is successful? on Splunk Search. 06-02-2017 02:52 PM
- Posted Re: Why does the search on my dashboard show "No result found" and fails to load the panel, but opening in search is successful? on Splunk Search. 06-02-2017 02:07 PM
- Posted Re: Why does the search on my dashboard show "No result found" and fails to load the panel, but opening in search is successful? on Splunk Search. 06-02-2017 02:01 PM
- Posted Re: Why does the search on my dashboard show "No result found" and fails to load the panel, but opening in search is successful? on Splunk Search. 06-02-2017 01:51 PM
- Posted Re: Why does the search on my dashboard show "No result found" and fails to load the panel, but opening in search is successful? on Splunk Search. 06-02-2017 12:52 PM
- Posted Re: Why does the search on my dashboard show "No result found" and fails to load the panel, but opening in search is successful? on Splunk Search. 06-02-2017 11:44 AM
- Posted Why does the search on my dashboard show "No result found" and fails to load the panel, but opening in search is successful? on Splunk Search. 06-02-2017 11:15 AM
- Tagged Why does the search on my dashboard show "No result found" and fails to load the panel, but opening in search is successful? on Splunk Search. 06-02-2017 11:15 AM
- Tagged Why does the search on my dashboard show "No result found" and fails to load the panel, but opening in search is successful? on Splunk Search. 06-02-2017 11:15 AM
- Tagged Why does the search on my dashboard show "No result found" and fails to load the panel, but opening in search is successful? on Splunk Search. 06-02-2017 11:15 AM
- Tagged Why does the search on my dashboard show "No result found" and fails to load the panel, but opening in search is successful? on Splunk Search. 06-02-2017 11:15 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
06-02-2017
03:12 PM
Bingo! That did it! Thanks man!
... View more
06-02-2017
02:57 PM
To clarify, the manual search looks like this:
host=108827 sourcetype=psirt_details matchConfidence="Vulnerable" | eval my_date=strftime(_time,"%B") | dedup my_date psirtColdId deviceId | chart count(psirtColdId) over "Description" by my_date usenull=F
Works like a champ
... View more
06-02-2017
02:52 PM
No change. One thing I noticed is that if I do a manual search WITH table my_date psirtColdId deviceId</query> in my parent search...it doesn't work.
... View more
06-02-2017
02:07 PM
That is my current panel search and changing | fields to | table did not change the result, unfortunately.
... View more
06-02-2017
01:51 PM
This doesn't look to have made a change, unfortunately. I used the same panel search as original posting plus what the other poster has suggested -- removing the search | from the panel search field.
... View more
06-02-2017
12:52 PM
Excluding " | search" did not make a difference, unfortunately. I have a parent search that uses a dropdown to populate the information that will be used in the panels, dependent on what is selected. If I create a static search that uses the values that would otherwise be passed via the dropdown....it loads just fine. I'm pretty confident its not an issue with my token, as if I do a "open in search" it uses the variable passed by the dropdown.
Only, it doesn't load in the dashboard for some reason..
... View more
06-02-2017
11:44 AM
That is the panel that is having problems, yes.
... View more
06-02-2017
11:15 AM
Hello!
As the title states, my dashboard fails to load a panel that performs a search. If I click "Open in search" I see the expected results.
Any idea why?
If I click "open in search" the following is in the search bar:
host=108827 sourcetype=psirt_details matchConfidence="Vulnerable" | eval my_date=strftime(_time,"%B") | dedup my_date psirtColdId deviceId | search | chart count(psirtColdId) over "Description" by my_date usenull=F
<form>
<label>PSIRTS per month by PSIRT description</label>
<search id="parent">
<query>host=$cust$ sourcetype=psirt_details matchConfidence="Vulnerable" | eval my_date=strftime(_time,"%B") | dedup my_date psirtColdId deviceId</query>
</search>
<fieldset submitButton="true" autoRun="true">
<input type="dropdown" token="cust">
<label>Customer</label>
<fieldForLabel>cpyName</fieldForLabel>
<fieldForValue>cpyKey</fieldForValue>
<search>
<query>sourcetype=companies managerUserId=name | dedup cpyKey | fields cpyKey, clusterName, cpyName, npUrl, managerUserId</query>
</search>
</input>
</fieldset>
<row>
<panel>
<title>Top customer PSIRT exposure, as of last 24 hours</title>
<table>
<search>
<query>sourcetype=psirt_details matchConfidence="Vulnerable" cpyKey=$cust$ | top "Description" psirtColdId</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
<row>
<panel>
<table>
<title>Number of devices impacted by selected PSIRT ID</title>
<search base="parent">
<query>search | chart count(psirtColdId) over "Description" by my_date usenull=F</query>
</search>
<option name="refresh.display">preview</option>
</table>
</panel>
</row>
</form>
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
