I am not sure why but on the main page, none of the searches return results - unless i remove references to the indexes on the tstats search. I assume this is related to the multi tenancy support that is breaking it.
| tstats values(nodename) AS nodename count FROM datamodel=Cisco_IOS_Event WHERE Cisco_IOS_Event.product="IOS" index=* BY host index | search nodename=Cisco_IOS_Event | stats sum(count)
returns nothing, but:
| tstats values(nodename) AS nodename count FROM datamodel=Cisco_IOS_Event WHERE Cisco_IOS_Event.product="IOS" BY host | search nodename=Cisco_IOS_Event | stats sum(count)
The Tenant search properly hides as the macro probably comes back with nothing; i have assigned the tenant_index token with a value of "" to partially fix this issue..
Is this a known problem? or, is it something I have not set up correctly?
that's a possibility, but the thing is this is how the dashboard came packaged; i I guess i should have said something more along the lines of 'it was broken out of the box and removing index references fixed it'
I'm getting this error running on 6.6.7.
Error in 'PivotProcessor': Error in 'PivotUtil': The dataset 'Interface' has no field 'index'.
I'm not sure what happened, but the data models/pivots seemed to start working after a few days. Maybe another restart was required??