Hi...a newbie here. I've been absorbing training materials and looking through questions here but find myself stuck on something I'm hoping is easily fixed. I have a timechart using a search of unsightly error messages which I rename for readability on chart. When I click on a chart bar, the linked search page opens, however the search string uses the renamed values in my chart's query.
For example, when I click on the bar labelled 'DB-connection error' for some date, the search opened uses the renamed value ('DB-connection error') instead of the original string to be searched ('Error connecting to database'). Any help is much appreciated!
Thanks, Michelle
Linked search:
sourcetype="AA42127:OQL:bulk" DB-connection error earliest=1579820400 latest=1579906800
Graph panel source:
<row>
<panel>
<title>FMDS Errors</title>
<chart>
<search>
<query>sourcetype="AA42127:OQL:bulk" "(ADDRESS_LIST=(FAILOVER=on)" OR "Failed delivery for" OR "Error connecting to database" OR "Setup of JMS message listener invoker failed for destination" OR "moveFailed" OR "debulkStatusResult: Exception" OR "FileStatus=FAILED" OR "FMT-ERROR" OR "MsgDebulk filename in Error" OR "MsgDebulk generation failed"
| timechart span=1d count(eval(match(_raw, "ADDRESS_LIST=*FAILOVER=on"))) as "ADDRESS_LIST_FAILOVER"
count(eval(match(_raw, "Failed delivery for"))) as "Failed delivery"
count(eval(match(_raw, "Error connecting to database"))) as "DB-connection errror"
count(eval(match(_raw, "Setup of JMS message listener invoker failed for destination"))) as "JMS message listener invoker failed"
count(eval(match(_raw, "moveFailed"))) as "moveFailed"
count(eval(match(_raw, "debulkStatusResult: Exception"))) as "debulkStatusResult: Exception"
count(eval(match(_raw, "FileStatus=FAILED"))) as "FAILED FileStatus"
count(eval(match(_raw, "FMT-ERROR"))) as "FMT-ERROR"
count(eval(match(_raw, "MsgDebulk filename in Error"))) as "MsgDebulk Filename Error"
count(eval(match(_raw, "MsgDebulk generation failed"))) as "MsgDebulk Generation Error"</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
<option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
<option name="charting.axisTitleX.visibility">visible</option>
<option name="charting.axisTitleY.visibility">visible</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.abbreviation">none</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.abbreviation">none</option>
<option name="charting.axisY.scale">log</option>
<option name="charting.axisY2.abbreviation">none</option>
<option name="charting.axisY2.enabled">0</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.bubbleMaximumSize">50</option>
<option name="charting.chart.bubbleMinimumSize">10</option>
<option name="charting.chart.bubbleSizeBy">area</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.showDataLabels">all</option>
<option name="charting.chart.sliceCollapsingThreshold">0.01</option>
<option name="charting.chart.stackMode">default</option>
<option name="charting.chart.style">shiny</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">0</option>
<option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisStart</option>
<option name="charting.legend.mode">standard</option>
<option name="charting.legend.placement">top</option>
<option name="charting.lineWidth">2</option>
<option name="refresh.display">progressbar</option>
<option name="trellis.enabled">0</option>
<option name="trellis.scales.shared">1</option>
<option name="trellis.size">medium</option>
<drilldown>
<link target="_blank">search?q=sourcetype="AA42127:OQL:bulk" $click.name2$ earliest=$earliest$ latest=$latest$&earliest=&latest=</link>
</drilldown>
</chart>
</panel>
</row>
... View more