Hi,
we have a strange behaviour with status indicator visualization on a dashboard.
We have two status indicator with the same search, but the first use a base search for the first part of the search (eg: index=main).
The first visualize the status indicator with a color and the second with another color, but if i open the searches they have the same result set.
Is it a bug or we have to set something?
Thank you
Hi,
I found the problem: the base search was index=myindex; but using this kind of search in a base search there is a limit about the number of fields. So I added "| fields myfield1 myfield2" after the first part, where myfield1 and myfield2 are the fields used in the sub-searches that populate status indicators.
So, i solved 🙂
Bye
@giorgiovolpini please accept your own answer to mark this question as answered.
PS: Be aware that Status Indicator with Post Process search where base search returns too many results may lead to truncated result.
@giorgiovolpini Please show the XML involved with both panels.