Thanks for the response. Using 6.5.2 soon to be on 6.6.1. I tried that as: | pivot ..... splitrow fieldname filter (fieldname ="some text1" OR fieldname="some text2") But that didn't execute. ... View more

Excellent thank you! ... View more

Our architecture team mostly resolved these. From what I could gather - there was some connectivity issues within the cloud hosting environment that led to this. Took months to get it resolved, thankfully we were still in a testing phase - big yellow warnings on all dashboards were troublesome... ... View more

I finally got the post-processing chained searches working - what I did was create a smaller kvstore lookup specifically for this search. It took the first lookup from ~500K rows to ~100K rows and 10 to 3 fields, and now the searches work OK. So my suspicion is that there was some issue with hitting default limits in the backend where the very large lookup wasn't working in the post-processing (chained) search. ... View more

Forgot to answer you're other question - yes there were other post-processing searches using ticket_base, that included stats and lookup commands. The raw data forked out to 6 charts total. ... View more

Thanks for the feedback. I intentionally put the $territory$ filter further down in a post-processing search so that if users change that filter (a multiselect), the data loads faster, since it apparently doesn't run the base search to return the raw data. Is this interpretation correct? It appears it is. I finally got the post-processing working, what I did was create a smaller lookup specifically for this search - it took the first lookup from ~500K rows to ~100K rows and with ~30% of the fields, and now the searches work OK. So my suspicion is that there was some issue with default limits in the backend where the very large lookup wasn't working in the post-processing (chained) search. ... View more

Do you think there could be issues because the lookup in the post-process search is large (300K rows)? Even if I include a stats command prior to the lookup in the post-process command, very similar to the "Chained post-process searches" example in the documentation, it still doesn't run. However, if I replace the lookup command with a join+inputlookup it runs, just painfully slow. It really doesn't like that specific lookup file. Well i've spent 6hrs on this now, maybe it's time to switch back to a raw search for each chart individually. ... View more

Yes they're spelled correctly. The search runs fine when I click 'Open in search' on the same chart panel that says: Error in 'lookup' command: Could not find all of the specified lookup fields in the lookup table. ... View more

Ok thanks for the link to the documentation. I'm clearly using base searches incorrectly, but I like the option of pulling the raw data only once for a dashboard, not having to pull it separately for each chart. I tried the "| table xyz | fields *" approach and that didn't work. Trying a bunch of permutations now, still nothing working. I think the moral of the story is i'm using base searches inappropriately, and they do weird things when used inappropriately. ... View more

I never got it working, I ended up using a KV store within our app instead to keep persistent data that we need. ... View more

Thanks for your help, it's working good after I added to the props.conf. ... View more

Thanks for that, I think these should be stable but will have to check. Note - the actual raw data doesn't come in formmated with return characters, so I had to modify the regex. Do you see any issues with how I did it below? I'm a regex noob. | gentimes start=-1 | eval _raw="<response status='success'><result> <thermal> <Slot1> <entry> <slot>1</slot> <description>Temperature @ Ocelot</description> <min>0.0</min> <max>60.0</max> <alarm>False</alarm> <DegreesC>36.0</DegreesC> </entry> <entry> <slot>1</slot> <description>Temperature @ Switch</description> <min>0.0</min> <max>60.0</max> <alarm>False</alarm> <DegreesC>37.5</DegreesC> </entry> <entry> <slot>1</slot> <description>Temperature @ Cavium</description> <min>0.0</min> <max>60.0</max> <alarm>False</alarm> <DegreesC>42.5</DegreesC> </entry> <entry> <slot>1</slot> <description>Temperature @ Intel PHY</description> <min>0.0</min> <max>60.0</max> <alarm>False</alarm> <DegreesC>35.0</DegreesC> </entry> <entry> <slot>1</slot> <description>Temperature @ Switch Core</description> <min>0.0</min> <max>85.0</max> <alarm>False</alarm> <DegreesC>62.0</DegreesC> </entry> <entry> <slot>1</slot> <description>Temperature @ Cavium Core</description> <min>0.0</min> <max>85.0</max> <alarm>False</alarm> <DegreesC>47.0</DegreesC> </entry> </Slot1> </thermal> </result> </response>" | table _raw | rex field=_raw "Temperature @ Ocelot<\/description>\s+(<\w+>[\w\d.]+<\/\w+>\s+){3}<DegreesC>(?<Temp_Ocelot>[^\<]+)" ... View more

No we didn't tag anything - i'm guessing the DA-ITSI-VIRTUALIZATION add-on does that for you. We just had to enable it, it was disabled by default. ... View more

Excellent thank you! I figured there was a built in way to do this. ... View more

Hi Guiseppe, Thanks for the reply. Unfortunately there are no fields extracted since it's coming in as this structured format. For example, one of the source is 'top' which is just the 'top' command output. A typical event has 100s of lines in it. If I try mvexpand on the _raw field: index=mihealth source=top | mvexpand _raw | table _raw Here is a snippet of the output (12 columns for each row, 100's of rows): PID USER PR NI VIRT RES SHR S pctCPU pctMEM cpuTIME COMMAND 4186 tomcat2 20 0 7714m 450m 7692 S 2.0 1.4 38:34.88 java 7114 root 20 0 15160 1200 808 R 2.0 0.0 0:00.01 top 7360 tomcat 20 0 21.8g 5.9g 7744 S 2.0 18.8 359:51.46 java 1 root 20 0 19344 1076 848 S 0.0 0.0 0:07.64 init 2 root 20 0 0 0 0 S 0.0 0.0 0:00.02 kthreadd 3 root RT 0 0 0 0 S 0.0 0.0 0:04.54 migration/0 4 root 20 0 0 0 0 S 0.0 0.0 0:11.94 ksoftirqd/0 5 root RT 0 0 0 0 S 0.0 0.0 0:00.00 stopper/0 6 root RT 0 0 0 0 S 0.0 0.0 0:02.92 watchdog/0 7 root RT 0 0 0 0 S 0.0 0.0 0:06.73 migration/1 8 root RT 0 0 0 0 S 0.0 0.0 0:00.00 stopper/1 9 root 20 0 0 0 0 S 0.0 0.0 0:06.23 ks It seems like i need some type of mvexpand, but it doesn't appear to expand based on return characters for each row in the raw data. ... View more

Ok thanks that's what I figured thanks. ... View more

Oh yes sorry about that, I was trying to do an eval statement before the subsearch so I had added that in. Here is the XML for what I just tried using the gentimes approach, which returns no results: <form> <label>Test_timepicker Clone</label> <fieldset submitButton="false"> <input type="time" searchWhenChanged="true"> <label></label> </input> </fieldset> <row> <panel> <chart> <search> <query> index=sm9_us source=interaction [ | gentimes start=-1 | addinfo | rename info_min_time as earliest, info_max_time as latest | fields earliest latest | eval search = "(" + earliest + " lt; _time AND _time lt;" + latest + ")" | return $search ] | timechart count span=1d </query> <sampleRatio>1</sampleRatio> </search> </chart> </panel> </row> </form> However, I did just find an alternate way to do this which seems to work as expected: <form> <label>Test_timepicker</label> <fieldset submitButton="false"> <input type="time" searchWhenChanged="true"> <label></label> <default> <earliest>-7d@w0</earliest> <latest>@w0</latest> </default> <change> <condition match="isnum($earliest$) OR isnum($latest$)"> <eval token="etok">$earliest$</eval> <eval token="ltok">$latest$</eval> </condition> <condition> <eval token="etok">relative_time(now(), $earliest$)</eval> <eval token="ltok">relative_time(now(), $latest$)</eval> </condition> </change> </input> </fieldset> <row> <panel> <title>Earliest: $etok$ Latest:$ltok$</title> <chart> <search> <query> index=sm9_us source=interaction OPEN_TIME_LOCAL_TZ&gt;$etok$ OPEN_TIME_LOCAL_TZ&lt;$ltok$ | eval _time=OPEN_TIME_LOCAL_TZ | dedup INTERACTION_ID | timechart count span=1d </query> <sampleRatio>1</sampleRatio> </search> </chart> </panel> </row> </form> It appears that the isnum() logical test won't return a malformed search when it's used within the input->change->condition tag. I've tried multiple presets and time ranges, and they all come back as epoch times. So now, as long as my other time fields is stored as an epoch time (e.g., OPEN_TIME_LOCAL_TZ in example above), then this works as expected. ... View more

I'm not sure what the gentimes command here actually does. But if i use your approach and try this (just comparing the _time field to test): index=sm9_us source=interaction [ | gentimes start=-1 | addinfo | rename info_min_time as earliest, info_max_time as latest | fields earliest latest | eval search = | search "(" + earliest + " < _time AND _time <" + latest + ")" | return $search ] | timechart count span=1d I get this error: Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression Does the "addinfo" command actually work though if the search isn't using the timerange picker to filter the default _time field? That is, there aren't entries for earliest and latest after the query in the xml: <query>....</query> <earliest></earliest> is not included <latest></latest> is not included ... View more