I have an index with data from two different sourcetypes. Each sourcetype has several different values which I have created field aliases for. When I run a search, all of the fields are shown with their aliases correctly.
However, if I save the search as a dashboard (which I will ultimately use with Text Inputs to search the data), the field aliases do not show up and further, the field extractions don't show up either.
I have given the dashboard global read rights (heard that might fix it) but it still isn't working.
What am I missing?
It is not the dashboard that needs global permissions, it is your knowledge objects which do. Go here:
Field aliases and search for yours. Change the
sharing settings to global and it will work everywhere.
Can you paste your search query which is working before you save as dashboard? Also if you can mention field with alias.
Have you tried running the search in Fast mode? Does it work?
It's a very simple search.
index="abc_security_sandbox" sourcetype="HL7" OR sourcetype="ABC1"
I did run it in Fast Mode and that did not return the Field Aliases.
Could that be the issue? The dashboard is running in 'Fast Mode' and needs to be run in 'Smart Mode' somehow via the Dashboard search?
@chrisschum, Which is the field you have created alias for? You mentioned that your original search was working fine (possibly running in smart or verbose) but the same did not work in fast mode.
Are you using alias field in the base search or afterwards? Try the following with your alias field.
index="abc_security_sandbox" sourcetype="HL7" OR sourcetype="ABC1" | search <YourAliasFieldName>
It would be better if you add more details with your sourcetype --> Field mapping and alias field name.
Are the dashboard and props.conf (in which you defined the ALIASes) in the same app? If not, you may need to alter your metadata for the app which defines your ALIASes to export its props to all other apps.