When using the following search:
source="HomeDP561210.csv" host="Owner-PC" sourcetype="csv" ContractingAgency="" tag=Home tag=Home | eval ActionObligationS1=tonumber(replace(ActionObligationS,",","")) | eventstats sum(ActionObligationS1) as Total | eval Total=if(Total>0,"$".tostring(Total,"commas"),"($".tostring(Total-1,"commas").")")
When creating a Bar Chart in Visualization with the Top values
of my above search which we then change to a Pie Chart, we save as a Dashboard panel
When viewing the saved Dashboard panel the message "Search is waiting for input..." is displayed without the newly created Pie Chart.
Hi,
change it to this:
source="HomeDP561210.csv" host="Owner-PC" sourcetype="csv" ContractingAgency="" tag=Home tag=Home | eval ActionObligationS1=tonumber(replace(ActionObligationS,",","")) | eventstats sum(ActionObligationS1) as Total | eval Total=if(Total>0,"$$".tostring(Total,"commas"),"($$".tostring(Total-1,"commas").")")
It looks like a conflict with the token syntax on dashboards, i only changed from one dollor sign to two dollar signs. ($ -> $$)
Greetings
Tom
Hi,
change it to this:
source="HomeDP561210.csv" host="Owner-PC" sourcetype="csv" ContractingAgency="" tag=Home tag=Home | eval ActionObligationS1=tonumber(replace(ActionObligationS,",","")) | eventstats sum(ActionObligationS1) as Total | eval Total=if(Total>0,"$$".tostring(Total,"commas"),"($$".tostring(Total-1,"commas").")")
It looks like a conflict with the token syntax on dashboards, i only changed from one dollor sign to two dollar signs. ($ -> $$)
Greetings
Tom
Tom,
Thanks for your input. It worked well!
Juan