Splunk Search

Why does my search work in the Search App, but not as an inline search in a dashboard?

edrivera3
Builder

Hi

I have the following search that works correctly in the search app, but when I tried to include it as an inline search in the dashboard, it doesn't work.

index="job_event" | search error_number=05071 | eval "ACS Name"=acs_name | chart dedup_splitvals=t limit=100 useother=f count AS "# of Errors"  by "ACS Name" test_number format=$VAL$:::$AGG$ | sort limit=100 acs_name | fields - _span  | fields "ACS Name" *

I already checked that all extracted fields have permission to appear in all apps and users.
I also tried to change all quotation marks to & quot; but nothing changed.

Tags (3)
1 Solution

Flynt
Splunk Employee
Splunk Employee

You'll need to double escape the VAL and AGG as single $'s mean look for a token in a dashboard.

Try this

 index="job_event" | search error_number=05071 | eval "ACS Name"=acs_name | chart dedup_splitvals=t limit=100 useother=f count AS "# of Errors"  by "ACS Name" test_number format=$$VAL$$:::$$AGG$$ | sort limit=100 acs_name | fields - _span  | fields "ACS Name" *

In your dashboard.

View solution in original post

Flynt
Splunk Employee
Splunk Employee

You'll need to double escape the VAL and AGG as single $'s mean look for a token in a dashboard.

Try this

 index="job_event" | search error_number=05071 | eval "ACS Name"=acs_name | chart dedup_splitvals=t limit=100 useother=f count AS "# of Errors"  by "ACS Name" test_number format=$$VAL$$:::$$AGG$$ | sort limit=100 acs_name | fields - _span  | fields "ACS Name" *

In your dashboard.

edrivera3
Builder

It worked perfectly. Thank you.

0 Karma

krwinters11
Path Finder

I am also interested in an answer to this, as I have a similar question out that involves this issue and using the R Project app. http://answers.splunk.com/answers/229941/why-does-an-r-search-not-work-on-a-dashboard.html

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...