I have created one base search and multiple services with entities and also created KPI using the base search.
I try to drag the KPI to glass table to get a count of particular service. In search, I get the alert value as 6 but in glass table, it shows as 0 or 10(sum of errors of all servers).
The same search is working if add a ad-hoc search in service.
Base search
index=os sourcetype=port_availability | dedup HostName |search Status!="Connection successful"| table _time HostName port Status| eval Priority="P3"
PFA screenshots for your reference,
2: /storage/temp/228771-base-search.jpg
You should open your KPI search and expand the macro out cmd + shift + e
. Then strip everything off below the first stats command and see what it's using to create the search. You are most likely not summing the value
In KPI search it showing the correct value. But not in glass table.
Also there is no option for count in Service/Aggregate calculation.