When doing this via the search bar index=xxxx | chart count by source, when you select a source in search it automatically adds in the extra escape character `\` in front of the file locations `\`, when doing it from a dashboard it does not add the extra slashes so it cannot find the source files. On search the search will look like this `\\file\\location\\here` when clicking on a source file that says `\file\location\here`, from the dashboard it keeps the original format `\file\location\here` and it cannot find the source because Splunk interprets the `\` character.
↧