I created a Dashboard from following search
sourcetype="TAFC_LOG_LINE" MANAGER | table _time _raw TransactionUUID | rename TransactionUUID as UUID | streamstats range(_time) as Duration by UUID | where Duration > 0.0
Now in Dashboard there is two option
UUID
Duration
When I click on duration I got above error with below message
PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'streamstats' command
Here is the XML for Dashboard
<?xml version='1.0' encoding='utf-8'?>
line
I modified my query and now its work.
is there any solution available for this ?
Just putting this as a comment because it's not really an answer, but I suspect your problems might have something common with this: http://splunk-base.splunk.com/answers/6076/parser-error-on-drilldown-when-using-table
Any update regarding my question?