I am making use of the Status Indicator App to create a dashboard which shows if steps in a process Passed, Skipped or Failed. I get my events from an xml file and I have been able to create the dashboard successfully with each step in the xml being reflected in the dashboard with their corresponding StepResult.
I am trying to sort the order of events showing in the dashboard based on the timestamp gotten from each step in the xml. Using my search query, the events are sorted properly when viewed in the Events and Statistics tab, but when I use the same search query in the Status Indicator App for my dashboard, the events become ordered alphabetically instead of using the timestamp I have extracted (StartTime). Any idea why the sort stops working when I insert the same search query in the Status Indicator App dashboard?
Here is my search query:
host=XXXX index=XXXX
| eval NewTime=strptime(StartTime,"%Y-%m-%dT%H:%M:%S.%3N") | eval _time=NewTime
| eventstats max(_time) AS lastestScan by Description
| where _time=lastestScan | stats count by StepResult, Description, _time| sort _time | eval color=case(StepResult=="Passed","green",StepResult=="Skipped","gold", StepResult=="Failed","red")
| eval StepResult = Description
Also, the colors for each step no longer show, but when I get rid of the _ time field in the stats command, the colors work again.
Any assistance would be appreciated.
Thanks in advance.
