topic Re: search help, token issue in Dashboards & Visualizations

search help, token issue

selvam_sekar — Wed, 17 Apr 2024 16:44:40 GMT

Hi,

if i run this query in simple search bar it works fine. However, when i create panel and add the below, i'm getting error as waiting for input.

Please could you advise?

index=hello sourcetype=welcome | stats max(DATETIME) as LatestTime | map search="search index=hello sourcetype=welcome DATETIME=$LatestTime$" | stats sum(HOUSE_TRADE_COUNT) as HOUSE_Trade_Count

Thanks,

selvam.

Re: search help, token issue

ITWhisperer — Wed, 17 Apr 2024 16:39:51 GMT

Try doubling up the $'s as single $ are for tokens in dashboards.

index=hello sourcetype=welcome | stats max(DATETIME) as LatestTime | map search="search index=hello sourcetype=welcome DATETIME=$$LatestTime$$" | stats sum(HOUSE_TRADE_COUNT) as HOUSE_Trade_Count

Re: search help, token issue

selvam_sekar — Wed, 17 Apr 2024 18:10:52 GMT

Thanks @ITWhisperer .

I also found an issue, if I run this query for yesterday I am getting the result as 44Million count but when I run the search for last 7 days I am getting only 23Million results.

Any suggestion to fix?

index=hello sourcetype=welcome | stats max(DATETIME) as LatestTime | map search="search index=hello sourcetype=welcome DATETIME=$$LatestTime$$" | stats sum(HOUSE_TRADE_COUNT) as HOUSE_Trade_Count

Re: search help, token issue

ITWhisperer — Thu, 18 Apr 2024 07:09:56 GMT

Suggestion is "don't use map". Map is an expensive, resource intensive, and slow command. Other ways to achieve this might be

index=hello sourcetype=welcome | eventstats max(DATETIME) as LatestTime | where DATETIME=LatestTime | stats sum(HOUSE_TRADE_COUNT) as HOUSE_Trade_Count