Hi Team,
I am trying to create a dashboard with base query taking values from data model . But it is not yielding any results(Only when i have that in basequery). Seems the base query syntax is wrong , since it starts with pipeline (|) . Any help on where i am going wrong.Thanks in advance
search id="test_basequery"
query | datamodel test_stats_data_model test_stats_data_set search
/query
I have a dashboard with dropdown [ having values for sourcetype] and then base search
|datamodel Authentication Authentication search | search sourcetype=$st$
this should then take the sourcetype and pull the relevant data from datamodel. would this help?