Hello,
My requirement is to display the results of related Service and KPI name if any of the below tile turns Yellow, red etc except Green (this we can verify using alert_level)
Created below look up table #sresellerpricing
Below is the query i'm using but not getting any results.
index=itsi_summary KPI IN ("ServiceHealthScore") alert_level>1 is_entity_in_maintenance=0
serviceid IN
("e46d2d3b-7b5a-40d4-aebf-54aa0b394e25",
"23ff8e98-59d0-48d6-a8d2-8a1385d26bd8",
"372848b0-380a-4fca-a78c-816747e00cf3")
| eval service_kpi_id=serviceid."-".kpiid
| search NOT service_kpi_id IN (
[ search index=itsi_summary KPI IN ("ServiceHealthScore") alert_level>1 is_entity_in_maintenance=0
serviceid IN
("e46d2d3b-7b5a-40d4-aebf-54aa0b394e25",
"23ff8e98-59d0-48d6-a8d2-8a1385d26bd8",
"372848b0-380a-4fca-a78c-816747e00cf3")
| eval service_kpi_id=serviceid."-".kpiid
| dedup service_kpi_id | return $service_kpi_id ]
)
| lookup sresellerpricing key AS kpiid OUTPUT Service
| dedup kpi Service
| table Service kpi
