topic Dashboard panel in Reporting

Dashboard panel

rahul2gupta — Mon, 13 Jul 2020 01:42:25 GMT

When I am running the following query in verbose mode it giving me results but not in fast mode.

index=symantec sourcetype=sep12:scan status=completed | stats count

As Dashboard panel uses fast mode.What necessary modification do I need to do to get the results in fast mode.

Regards,

Rahul

renjith_nair — Mon, 13 Jul 2020 05:19:16 GMT

It's normally because of the extracted fields. Use "|fields " to explicitly specify the field

Try

index=symantec sourcetype=sep12:scan |fields status|where status=completed |stats count

rahul2gupta — Mon, 13 Jul 2020 05:29:25 GMT

I tried but it did not worked.Please find the screen shot below.

Regards,

Rahul

renjith_nair — Mon, 13 Jul 2020 05:41:27 GMT

Can you try this in fast mode and see if you are getting events with status?

index=symantec sourcetype="sep12:scan" status=*

index=symantec sourcetype="sep12:scan" |fields *

rahul2gupta — Mon, 13 Jul 2020 06:34:18 GMT

I ran the following query index=symantec sourcetype="sep12:scan" |fields * and I could able to get events in fast mode.

Please find the screen shot below.

But it did not worked for index=symantec sourcetype="sep12:scan" status=*

Regards,

Rahul

renjith_nair — Mon, 13 Jul 2020 07:32:56 GMT

So you might have multiple field extraction and hence it needs explicit mention about fields

So you may use

index=symantec sourcetype="sep12:scan" |fields * |where status="completed"

rahul2gupta — Mon, 13 Jul 2020 07:45:55 GMT

I used the following query index=symantec sourcetype=sep12:scan status=completed |fields * |stats count

and it worked.

Regards,

Rahul