How to find unique events in a dashboard with a base search and several post-process searches?

polssn — Thu, 22 Mar 2018 16:05:50 GMT

I have a dashboard which uses a base search that finds all events that we are interested in, then use post-process searches to classify this data into several different categories ("known concerns").

In the end, I want to display all events that are not picked up by any of these post-process searches, but I can't seem to find any primitive that would do this.

Basically, the logic I need is: BASE XOR (CATEGORY1 OR CATEGORY2 OR ...)

Ideally without having to duplicate the post-process searches again, since the results are already found.

Re: How to find unique events in a dashboard with a base search and several post-process searches?

mayurr98 — Thu, 22 Mar 2018 16:39:19 GMT

So in short you need to filter out post process searches using NOT and OR operator.
Your query would be BASE NOT (CATEGORY1 OR CATEGORY2 OR ...)

Try this run anywhere XML

<dashboard>
  <label>Post Process Searches</label>
  <search id="Base_Search">
       <query>index=_internal | head 1000</query>
   </search>
  <row>

    <panel><title>ERROR</title>
      <event>
        <search base="Base_Search">
           <query>| search "ERROR"</query>
       </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
  <row>
    <panel><title>INFO</title>
      <event>
        <search base="Base_Search">
           <query>| search "INFO"</query>
       </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
  <row>
    <panel><title>WARNING</title>
      <event>
        <search base="Base_Search">
           <query>| search "WARNING"</query>
       </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
   <row>
    <panel><title>NOT "ERROR" NOT "WARNING" NOT "INFO"</title>
      <event>
        <search base="Base_Search">
           <query>| search NOT "ERROR" NOT "WARNING" NOT "INFO"</query>
       </search>
        <option name="list.drilldown">none</option>
      </event>
    </panel>
  </row>
</dashboard>

let me know if this helps!

topic How to find unique events in a dashboard with a base search and several post-process searches? in Dashboards & Visualizations

How to find unique events in a dashboard with a base search and several post-process searches?

Re: How to find unique events in a dashboard with a base search and several post-process searches?