Base Search (works):
index="my_index" sourcetype="my:logging:system" name="payBill" host="$host$" userId="$userId$" | eval date=strftime(timestamp/1000, "%c")|table name host userId clientId date legacyAccount partialAmount invoiceId vbeln xblnr dueDate invoiceDate| rename name as "Event", host as "Server", userId as "User ID", clientId as "Client ID", date as "Date", vbeln as "Billing Document", xblnr as "Reference Document", legacyAccount as "Legacy Account", dueDate as "Due Date", invoiceDate as "Invoice Date", invoiceId as "Invoice ID", dueDate as "Due Date", partialAmount as "Payment Amount"
Dashboard Search (doesn't work):
index="my_index" sourcetype="my:logging:system" name="payBill" host="$host$" userId="$userId$" | eval date=strftime(timestamp/1000, "%c")|table name host userId clientId date legacyAccount partialAmount invoiceId vbeln xblnr dueDate invoiceDate| rename name as "Event", host as "Server", userId as "User ID", clientId as "Client ID", date as "Date", vbeln as "Billing Document", xblnr as "Reference Document", legacyAccount as "Legacy Account", dueDate as "Due Date", invoiceDate as "Invoice Date", invoiceId as "Invoice ID", dueDate as "Due Date", partialAmount as "Payment Amount"
... View more