0

  I've built a dashboard that has functions   tstats and search ID It uses The problem here is that it does not show the output in the sub-queries For example, the main search is as follows

search id = "host_status"      query | tstats count as COUNT where (index = *) by _time, host / query    / search

And for the following searches, the following is used

panel        title abcd 8h / title        chart          search base = "host_status"            query search (index = aaa) | timechart span = 1m eval (avg (COUNT) / 60) as eps by host / query

         / search Unfortunately, there is no output for graphical display Please guide Thanks

  • This is post-processing. The base search produces preliminary results which subsequent searches refine. In this case, however, search abcd is gathering its own results and not using those produced by host_status. Remove base="host_status" and the panel should work. To test post-processing, run the combined query in a search window. In this case, ` | tstats count as COUNT where (index = *) by _time, host | search (index = aaa) | timechart span = 1m eval (avg (COUNT) / 60) as eps by host. BTW, if you use the code {}` button you can post your XML as-is. – RichG Jul 20 at 12:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.