Dashboards & Visualizations

makeresult Work in normal Search app but not in my Dashboard

mklhs
Path Finder

Hello,

i want to build a dashboard with different panels to Analyse some Alarms.
At the Top i have 2 Input fields field1(text input) and field2(dropdown for status)
I want to habe a panel or an hidden query where i build with | makeresult some Values and write them into my index. Like an Kommentary Funktion for Analysis.
My Problem is now that if i use this query in normal Search app:

| makeresults
| eval event_hash=123
| eval kommentar=abc
| eval wann = now()
| table event_hast kommentar wann

it works perfectly....

But if im going to Save this as a dashboard Panel and look at my Dashboard, it say that no Results get Reflected.

Anyone know This issue?

Thanks for your Help

0 Karma

woodcock
Esteemed Legend

As I suspected, you saved it with the Events visualization instead of the Statistics. Change this:

<event>
...
</event>

To this:

<table>
...
</table>

mklhs
Path Finder

Thank you for your Time
This is the Part from my Dashboard, if you need more Tell me
My Dashboard:

<form>
  <label>Analyse Dashboard</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="text" token="analyse_result" searchWhenChanged="true">
      <label>Analyse Ergebnis</label>
    </input>
    <input type="dropdown" token="alarm_status">
      <label>Alarm Status ändern</label>
      <choice value="Open">Offen</choice>
      <choice value="Work">In Arbeit</choice>
      <choice value="Closed">Geschlossen</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <search>
          <query>| makeresults 
| eval event_hash=123 
| eval alarm_phase = "Open" 
| eval wann = now() 
| eval kommentar="bla" 
| table event_hash alarm_phase wann kommentar</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="list.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </event>
    </panel>
  </row>
</form>
0 Karma

woodcock
Esteemed Legend

Post your dashboard XML so we can all play.

0 Karma

mklhs
Path Finder

Thank you for your Time
This is the Part from my Dashboard, if you need more Tell me
My Dashboard:

Analyse Dashboard

 <input type="text" token="analyse_result" searchWhenChanged="true">
      <label>Analyse Ergebnis</label>
    </input>
    <input type="dropdown" token="alarm_status">
      <label>Alarm Status ändern</label>
      <choice value="Open">Offen</choice>
      <choice value="Work">In Arbeit</choice>
      <choice value="Closed">Geschlossen</choice>
    </input>


    <panel>
      <event>
        <search>
          <query>| makeresults 
| eval event_hash=123 
| eval alarm_phase = "Open" 
| eval wann = now() 
| eval kommentar="bla" 
| table event_hash alarm_phase wann kommentar
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="list.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </event>
    </panel>
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...