Wazuh + Grafana problem

[Brenno Garcia]

Hello, 

I recently created a new index to store alerts from the Wazuh browser history, as follows:

https://groups.google.com/g/wazuh/c/jzLL3qAu6lk

It worked, and I changed the Grafana data source to match this new index:

It worked, but suddenly today, the Grafana dashboard stopped returning any values.

But if I query the data source, the values ​​are returned normally.

[Gustavo Choquevilca]

Hello Breno,

Thanks for the details. This information is very useful.

So the good news is it doesn't look like an auth issue or a connectivity problem between Grafana and the Wazuh indexer. The Explore view returning data confirms the datasource is working fine.

The dashboard panels showing 0 while Explore works usually points to something specific to the panel config itself. Can you check a couple things for us?

1. Dashboard variables — go to Dashboard Settings → Variables and check what values `$agent_name` and `$User` are resolving to. If either one is empty, null, or not matching anything in the index, all panels will return 0. As a quick test, try hardcoding `*` in place of those variables directly in one of the panel queries and see if data comes back.

2. Datasource per panel — open one of the broken panels in edit mode and confirm it's pointed at `Wazuh_Browser_Index` (the one with `wazuh-alerts-4.x-b*`).

3. Time range — just to rule it out, bump the dashboard time range to Last 24h and see if anything shows up.

4. One more thing worth trying — open your browser's DevTools (F12), go to the Network tab, and reload the dashboard. Look for the requests Grafana sends to the datasource and check if any of them are returning errors or unexpected responses. That'll tell us pretty quickly if the queries are actually hitting the index or failing silently somewhere along the way.

Share your findings and we'll keep investigating from there

[Gustavo Choquevilca]

Hello,
Were you able to check what was mentioned earlier? Feel free to ask me if the issue is still there!