Dashboard panel

[rahul2gupta]

Hi @isoutamo ,

When I am running the following query in verbose mode it giving me results but not in fast mode.

index=symantec sourcetype=sep12:scan status=completed | stats count

As Dashboard panel uses fast mode.What necessary modification do I need to do to get the results in fast mode.

Regards,

Rahul

[renjith_nair]

@rahul2gupta 

It's normally because of the extracted fields. Use "|fields " to explicitly specify the field

Try

index=symantec sourcetype=sep12:scan |fields status|where status=completed |stats count

[rahul2gupta]

Hi @renjith_nair ,

I tried but it did not worked.Please find the screen shot below.

Regards,

Rahul

[renjith_nair]

Can you try this in fast mode and see if you are getting events with status?

index=symantec sourcetype="sep12:scan" status=*

OR

index=symantec sourcetype="sep12:scan" |fields *

[rahul2gupta]

Hi @renjith_nair .

I ran the following query index=symantec sourcetype="sep12:scan" |fields * and I could able to get events in fast mode.

Please find the screen shot below.

But it did not worked for index=symantec sourcetype="sep12:scan" status=* 

Regards,

Rahul

[renjith_nair · Accepted solution]

@rahul2gupta,

So you might have multiple field extraction and hence it needs explicit mention about fields

So you may use

index=symantec sourcetype="sep12:scan" |fields * 
|where status="completed"

[rahul2gupta]

Hi @renjith_nair ,

I used the following query index=symantec sourcetype=sep12:scan status=completed |fields * |stats count

and it worked.

Regards,

Rahul