Hi at all,
I have a search very simple (tag=MYTAG) that gives to me results that I use in a timechart count by a field (myfield) and correctly runs giving time distribution for the two values of myfield (OK, KO).
tag=MYTAG | timechart count by my_field
If I use it in a Data Model, I have as result of the related Pivot three values (OK, KO, NULL) instead the correct two values.
Exploding results as search, I see that Data Model added to my search (tag=MYTAG) the additional condition (index=* OR index=_*) that gives the problem of the NULL values.
Why this appens? I was wrong in Data Model Configuration?
Is there a way to avoid this?
but MYTAG search is index=my_index sourcetype=my_sourcetype so the problem isn't the default indexes path.
The problem that I don't understand is why Data Model adds the condition (index=* OR index=_*) ?