I'm having a lot of trouble with one of my Post-process searches. I have the following dashboard built.
<dashboard>
<search id="base">
<query>
sourcetype=foo errorCode=1 OR errorCode=ABC-1 NOT [search sourcetype=foo "Success" | dedup ip | fields ip]
| dedup ip
| fields ip
</query>
<earliest>-4h@m</earliest>
<latest>-5m</latest>
<sampleRatio>1</sampleRatio>
</search>
<label>ABC-1</label>
<description>ABC-1 Errors</description>
<row>
<panel>
<title>ABC-1 Errors Last 4 Hours - Unresolved</title>
<single>
<search base="base">
<query>
stats dc(ip)
</query>
</search>
</single>
</panel>
<panel>
<title>Total ABC-1 Errors Last 4 Hours</title>
<single>
<search>
<query>
sourcetype=foo errorCode=1 OR errorCode=ABC-1 | stats dc(ip)
</query>
</search>
</single>
</panel>
</row>
<row>
<panel>
<title>List of Unresolved ABC-1 IP Addresses</title>
<table>
<search base="base">
<query>
| table ip
</query>
</search>
</table>
</panel>
</row>
</dashboard>
The first inline search has no issues and the bottom post process search works (| table ip - gives me the table of IP addresses). However the stats dc search (stats dc(ip) - ABC-1 Errors Last 4 Hours - Unresolved) gives me incorrect results. When I open in search, the search is over all time and simply:
sourcetype=foo errorCode=1 OR errorCode=ABC-1 | stats dc(ip)
It seems to have dropped the sub-search and time range. What am I doing wrong here?
Thanks!
My fault - was looking at the wrong panels, I cleaned this up and it works fine now.
My fault - was looking at the wrong panels, I cleaned this up and it works fine now.
Hi
you have used base="base"
in only 2 panels.
Not used in "Total ABC-1 Errors Last 4 Hours" panel.
Is it proper as per your dashboard logic?
Try this for your base search
sourcetype=foo errorCode=1 OR errorCode=ABC-1 NOT [search sourcetype=foo "Success" | dedup ip | fields ip]
| stats count by ip
ABC-1 Errors Last 4 Hours - Unresolved search as
| stats count as Unresolved_IP