I have a dashboard with one search and basically it has 3 conditional drilldowns routing to 3 different dashboards. My first conditional drilldown works perfectly, but the rest are not working. Not sure where I'm going wrong. Any help is appreciated.
In the dashboard, this is my search:
sourcetype=opl_soa RFault="remoteFault" source="/logs/SOA_MS*-diagnostic.log" host="mialvsoaap0*p" | append [search BFault="bindingFault" source="/logs/SOA_MS*-diagnostic.log" host="mialvsoaap0*p"] | append [search BusinessFault ="business fault" source="/logs/SOA_MS*-diagnostic.log" host="mialvsoaap0*p"]|timechart span=5m count(RFault) as RemoteFaults, count(BFault="bindingFault") as BindingFaults,count(BusinessFault ="business fault") as BusinessFaults
and I have 3 drilldowns pointing to 3 different dashboards in the main dashboard where the above search is residing.
First one works and the other two do not. Any suggestions? Attached the code image:
Thank You ! it worked . one more question .
On the Main dash board , i have a timer on the panel and if i want to default it to last 4 hours . how can i do that ?
the reason is if i drill down to some other page and get back to main dashboard , My timer on the main dashboard will start pulling "ALL time " by default and i want it to be defaulted to 4 hours and if anybody want to search based on some other time , then they can set it to some other time like last 24 hors , last 60 mins etc .
Thank You ! it worked .
One more question ..
Is there any option where I can traversere from Sub dashboards to Main Dashboard ?
For example i have one Main dashboard where in i can drill down to 3 sub sub dashboards .
When i go to sub dashboard , can i have a link pointing to Main Dashboard and after clicking it routes to main dashboard ?
Slightly off-topic: Do not append three searches to each other. Instead, use OR:
sourcetype=opl_soa source="/logs/SOA_MS*-diagnostic.log" host="mialvsoaap0*p" (RFault="remoteFault" OR BFault="bindingFault" OR BusinessFault="business fault" | timechart ...
Should run much faster.