Post-process search drops subsearch and timerange from query

[johnansett]

I'm having a lot of trouble with one of my Post-process searches. I have the following dashboard built.

<dashboard>
         <search id="base">
          <query>
            sourcetype=foo errorCode=1 OR errorCode=ABC-1 NOT [search sourcetype=foo "Success" | dedup ip | fields ip]
            | dedup ip
            | fields ip
          </query>
          <earliest>-4h@m</earliest>
          <latest>-5m</latest>
          <sampleRatio>1</sampleRatio>
        </search>
  <label>ABC-1</label>
  <description>ABC-1 Errors</description>
  <row>
    <panel>
      <title>ABC-1 Errors Last 4 Hours - Unresolved</title>
      <single>
        <search base="base">
          <query>
            stats dc(ip)
           </query>
        </search>
      </single>
    </panel>
    <panel>
      <title>Total ABC-1 Errors Last 4 Hours</title>
      <single>
        <search>
          <query>
            sourcetype=foo errorCode=1 OR errorCode=ABC-1 | stats dc(ip)
          </query>
        </search>
      </single>
    </panel>
  </row>
    <row>
    <panel>
      <title>List of Unresolved ABC-1 IP Addresses</title>
      <table>
        <search base="base">
                    <query>
                      | table ip
                     </query>
        </search>
      </table>
    </panel>
  </row>
</dashboard>

The first inline search has no issues and the bottom post process search works (| table ip - gives me the table of IP addresses). However the stats dc search (stats dc(ip) - ABC-1 Errors Last 4 Hours - Unresolved) gives me incorrect results. When I open in search, the search is over all time and simply:

sourcetype=foo errorCode=1 OR errorCode=ABC-1 | stats dc(ip)

It seems to have dropped the sub-search and time range. What am I doing wrong here?

Thanks!

[johnansett · Accepted solution]

My fault - was looking at the wrong panels, I cleaned this up and it works fine now.

[kamlesh_vaghela]

Hi
you have used base="base" in only 2 panels.

1. ABC-1 Errors Last 4 Hours - Unresolved.
2. List of Unresolved ABC-1 IP Addresses.

Not used in "Total ABC-1 Errors Last 4 Hours" panel.

Is it proper as per your dashboard logic?

[somesoni2]

Try this for your base search

sourcetype=foo errorCode=1 OR errorCode=ABC-1 NOT [search sourcetype=foo "Success" | dedup ip | fields ip]
 | stats count by ip

ABC-1 Errors Last 4 Hours - Unresolved search as

| stats count as Unresolved_IP