Hi,
I'm having an issue with some dashboard of the Cisco Network App.
Take for example the routing dashboard. There is a top neihbors panel. When I open the dashboard, it does the search and returns "No results found".
However when I do I job inspection, I see it does find results:
This search has completed and has
returned 2,520 results by scanning
3,930 events in 2.133 seconds
When opening the job in search, I also see all the data. The query seems to work, but not in the dashboard panel...
I've checked the roles and made sure all roles that can have access, have a default search on all internal indexes. This is needed because the search itself uses index*.
The search it executes:
eventtype=cisco_ios-routing index IN (*)
| eval routing_protocol = case(eventtype == "cisco_ios-routing-ospf", "OSPF", eventtype == "cisco_ios-routing-dual", "EIGRP", eventtype ==> "cisco_ios-routing-bgp", "BGP", eventtype == "cisco_ios-routing-ldp","LDP", eventtype =="cisco_ios-routing-isis", "ISIS", eventtype == "cisco_ios-routing-rsvp", "RSVP", eventtype =="cisco_ios-routing-pim", "PIM")
| search (routing_protocol="BGP" OR routing_protocol="OSPF")
| lookup dnslookup clientip as src_ip | top clienthost
I do get data back, so it seems all datamodels are correct.
I'm really at a loss why it would return "no results" when inspecting or running the search does return results :s
Setup: index and search cluster, everything running on version 8.0.0. App is the latest version.
... View more