I am new to ITSI am attempting to run the below KPI search. It works fine in a regular search and when previewing the results at the time of setting up the KPI, but returns "No Data" in the service analyzer view?
index=os sourcetype=cpu | lookup serverlist Server_Name as host | search Sever_Use=web Sever_Type=linux | eval pctUsed=(100-pctIdle)
Server_Name, Server_Use, Server_Type
Server1 Web Linux
Server2 DB Windows
Note: I am attempting to use this lookup instead of adding tags to all of my servers.
Maybe I am missing something here.