Looking at some of the built in dashboards in Enterprise Security, there is a macro named useother
| tstats
count from datamodel=Web.Web where * by _time,Web.status span=10m | timechart minspan=10m useother=useother
count by Web.status | drop_dm_object_name("Web")
It appears to set the value to true.
title = useother
args = none
definition = true
Can anyone explain why this is used instead of useother=true?
HI,
they probably used this a lot in ES, so its easier if you want to change it to false, to have a marco. Thats probably it.
Just for better maintenance. Thats what a macro is for.
HI,
they probably used this a lot in ES, so its easier if you want to change it to false, to have a marco. Thats probably it.
Just for better maintenance. Thats what a macro is for.
Thanks, that makes sense.