![]() ![]() In your case, in the panel you have the field 'me' that isnt listed in the base search so you have to add the fields command with al the fields to use in panels (me, etc.): indexxyz. You would be better off running independent searches instead of post processing which might perform better and not truncate results/timeout due to limitations of post processing. if in a base search you dont use a streaming command as stats or timechart, you have to use the fields command to list all the fields to use in the panels. You should change | fields * with the transforming command you need.Ĥ) If you are not able to use transforming command in your base search due to any of your post process search. ![]() PS: This is just for testing (or rather make your code work). As per the dashboard Simple XML snippet, only one field in your example I have use | fields Type, you can extend to the other fields you need. If there is just one post process search using the base search then Post Processing is obviously not required. Since you have used post processing, I expect that you have some other post process searches running in your dashboard and the actual answer might change based on which fields you have used. Refer to documentation: Ģ) When you use post processing, ideally you do not require earliest and latest tag in post process searches, which will be ignored anyways.ģ) You can try out the following example. The post process searches will drop events or timeout if the limitations are breached. Panels in the dashboard use a post-process search to further modify the results of the base search. Each Single Value also needs to filter data so that SV1 shows all eventtypes, SV2 shows eventtype1. For example, if you have a dashboard running several searches that are similar, you can save search resources by creating a base search for the dashboard. I have a dashboard with a base search, three Single Values use the base search, but will only populate using stats, I would like to utilize timechart for the three Single Values to show trending data. Refer to the Best Practices for Post Processing Searches. A search on which you can base multiple similar searches. Another thing to remember about base searches is that any post-process search utilizing the base search is limited to only the fields and results that the base search produces. ![]() baseSearchand ensure that baseSearch only retains the required fields as a result of some transforming (statistical) command like stats or chart etc. A caveat with base searches is that you cannot export data from the panels - you would need to open the panel in search and export from there. You should try to incorporate the following:ġ) Base search should ideally contain transforming command, you should evaluate all the searches which refer to your base search i.e. Your limitation is not from Timepicker, it is actually because of post-processing you have used in the snippet posted here. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |