I have a dashboard which uses a base search that finds all events that we are interested in, then use post-process searches to classify this data into several different categories ("known concerns").
In the end, I want to display all events that are not picked up by any of these post-process searches, but I can't seem to find any primitive that would do this.
Basically, the logic I need is: BASE XOR (CATEGORY1 OR CATEGORY2 OR ...)
Ideally without having to duplicate the post-process searches again, since the results are already found.
So in short you need to filter out post process searches using NOT
and OR
operator.
Your query would be BASE NOT (CATEGORY1 OR CATEGORY2 OR ...)
Try this run anywhere XML
<dashboard>
<label>Post Process Searches</label>
<search id="Base_Search">
<query>index=_internal | head 1000</query>
</search>
<row>
<panel><title>ERROR</title>
<event>
<search base="Base_Search">
<query>| search "ERROR"</query>
</search>
<option name="list.drilldown">none</option>
</event>
</panel>
</row>
<row>
<panel><title>INFO</title>
<event>
<search base="Base_Search">
<query>| search "INFO"</query>
</search>
<option name="list.drilldown">none</option>
</event>
</panel>
</row>
<row>
<panel><title>WARNING</title>
<event>
<search base="Base_Search">
<query>| search "WARNING"</query>
</search>
<option name="list.drilldown">none</option>
</event>
</panel>
</row>
<row>
<panel><title>NOT "ERROR" NOT "WARNING" NOT "INFO"</title>
<event>
<search base="Base_Search">
<query>| search NOT "ERROR" NOT "WARNING" NOT "INFO"</query>
</search>
<option name="list.drilldown">none</option>
</event>
</panel>
</row>
</dashboard>
let me know if this helps!