I am VERY new to Splunk. I'm attempting to create a dashboard where I can search an Application name and info about the application itself, the app servers it runs on, the databases that support the app, and the database servers that support the databases. I can get every panel to return results except for one.
index="databaseserver_temp" Application=$appservicefield$ | join Database [search index="applicationdatabase_temp"] | table Application, Database, VM, InstanceName
When I remove the token search "Application=$appservicefield$ I can view results, however they do not pertain to the one application I'm searching. But when I include the token, I get a "No results found" message. Not sure why the token isn't working for this particular search.
↧
