Is there a way to filter by source in a post process search?

[Sundried]

Hi,

I have a base search and post process searches on a dashboard that need to be split by source, but it doesn't appear like splitting by source works. The only thing shared is the index, and some fields but depending on the source I need to evaluate the fields differently. For instance:

Base search:
index=test_logs | fields A

Two post process searches:

| search source=sourceA

.

(evaluate field A certain way because it's from source A)

| search source=sourceB

.

(evaluate field A a different way as it's from source B)

The problem is that when I do this nothing will load. I've found the only way to get this to work is to put the source in the base search but then I wouldn't be able to do my evaluations properly.

[bowesmana]

If you have a base search with

| fields A

then you will only have one field 'A' - you will not have a field called source.

The best use of base searches is to aggregate rather than just pass raw events - although that's possible.

Can you give more detail on what your two post process searches want to do with a little more detail.

What do you mean 'can't do your evaluation properly'?

[Sundried]

So field A is a common field, which are names of files. The way they have been onboarded is that they are separated by a source name, so source A field A will be a set of files that are evaluated under one panel. Then source B field A are a set of files too, but to be evaluated under another panel with different parameters/output.

I've tried to put the sources in the base search and then calling the sources again in their respective panels but nothing loads too.

[bowesmana]

Can you post your SPL of the base + the panel searches

[Sundried]

Base:

index=logs source=A OR source=sourceB | fields fileName

Panel 1:

search source=sourceA

| table fileName

Panel 2:

search source=sourceB

| table fileName

[bowesmana · Accepted solution]

Just add 'source' to your fields statement in the base search.

There's no reason why that shouldn't work for your panel searches. What is your result?

If you get no results, open the search up in a new window from the panel magnifying glass and see what the search gives you.

[Sundried]

This worked. Thanks mate. Didn't know source was treated that way.