I have a dashboard panel with a table. I am able to change the drilldown search when selecting a row in the panel table to open a new window with the new search:
<search>
<query>index=$Environment$ ( program=*shot_director OR program=cryo_director* ) shot_Id=$shotIdPattern$ "Commanded|GoToState" | sort _time | table _time,program,shot_Id,slc_State</query>
<earliest>$shotEarliest$</earliest>
</search>
<drilldown>
<link target="_blank">
/app/search/search?q=search index=$Environment$ "<macro_step_complete>" "Execution of Macro Step " shot_id=$shotIdPattern$ | eval subsystem=shot_supervisor | sort -_time
</link>
</drilldown>
but when I add the regex
| rex field=taxon (?<ss>[^|]*)[|]
creating
/app/search/search?q=search index=$Environment$ "<macro_step_complete>" "Execution of Macro Step " shot_id=$shotIdPattern$ | rex field=taxon (?<ss>[^|]*)[|] | eval subsystem=shot_supervisor | sort -_time
the search window created results in:
index=iccs_int "<macro_step_complete>" "Execution of Macro Step " shot_id=N160613-003* | rex field=taxon (
in the search box and the error
Error in 'rex' command: Encountered the following error while compiling the regex '(': Regex: missing )
It seems the "?" in the regex is being consumed before it is being sent to the search app.
Any ideas?
Thanks in advance!
... View more