HI
I use a dropdown in simple XML to select between different scheduled saved searches. As far as I know, in simple XML I can only use the tag "searchTeamplate" to work with variables.
so I use loadjob to get the results of my search within the searchTemplate tag:
| loadjob savedsearch="username:appname:mysearch-$timerange$"
Switching between different scheduled saved searches (using "timerange" as value) works fine like that. But the results all apear as table.
How can I produce other output than tables (i.e. pie charts) with loadjob results?
Kind regards
Mathias
Try to give the answer myself.
I think the search was too complicated (including "append") and it was already computed with a stats command. I did a much simpler search using streamstats and now I can use whatever charts (i.e. pie) with loadjob.
.. mathu
With simple XML, the format of the output has to do with the type of XML element inside your <row> elements. You can use <table>, <chart>, <events>, etc. It's not affected by the type of search you're doing.
In this case it's not a problem of the XML element. If I use
The problem is that "loadjob" only generates table output, even if I use
Maybe "loadjob" is not the correct way to search. But so far it't the only command I've found for my problem.