I'm trying to build a form with a base search and post processing search as below. The panel gets loaded from a drilldown with ...<panelname>?form.host=<hostname>
I don't get any results for the field PercentSystemTime
. The table just shows the timestamps and st as "Is Null", but if I click onto 'Open in Search' (the lens in the lower left corner), then I get the values displayed. And what is really is puzzling me, it works if I modify the search in the panel so it does not use the base search.
<form>
<fieldset autoRun="true" submitButton="false">
<input type="time" token="time_picker">
<label>Time Range</label>
<default>
<earliestTime>-30m</earliestTime>
<latestTime>now</latestTime>
</default>
</input>
<input token="host" >
</input>
</fieldset>
<row>
<panel>
<search id="HostBaseSearch">
<query>index=os host=$host$ </query>
<earliest>$time_picker.earliest$</earliest>
<latest>$time_picker.latest$</latest>
</search>
<table>
<search base="HostBaseSearch">
<query>
search sourcetype="cpu"
| eval st=if(ISNULL(PercentSystemTime),"Is Null",PercentSystemTime)
| table _time st
</query>
</search>
</table>
</panel>
</row>
</form>
Modified Search in the panel which works:
<search>
<query>
index=os host=$host$ sourcetype="cpu"
| eval st=if(ISNULL(PercentSystemTime),"Is Null",PercentSystemTime)
| table _time st
</query>
</search>
To use post process searches you must use a transforming command before you reference searches will work. A transforming command is fields, tables, stats, etc. There is also limit of events which can be passed from the base to the reference search.
index=os host=$host$ sourcetype="cpu" | fields _time host PercentSystemTime
OR
index=os host=$host$ sourcetype="cpu" | table _time host PercentSystemTime
To use post process searches you must use a transforming command before you reference searches will work. A transforming command is fields, tables, stats, etc. There is also limit of events which can be passed from the base to the reference search.
index=os host=$host$ sourcetype="cpu" | fields _time host PercentSystemTime
OR
index=os host=$host$ sourcetype="cpu" | table _time host PercentSystemTime
basic error, and I did not notice it as I had transforming commands in the other dashboards I build by accident 😉
Thanks you for your reply