In a dashboard, a single panel using a lookup and geostats works fine. When I take that search and split it up to use a base search with multiple panels it semi-breaks. The Cluster map will start loading but the pie charts appear then disappear. The other panels on the dashboard are pie charts and they all load appropriately. Once the search completes however, if you click refresh the cluster map results will display properly. Is this a problem with my source, the SPL, or something else (bug)? Source below is just the Panel for the Cluster map I am having problems with. <form> <label>Firewall Clustermap</label> <description>Inbound Traffic</description> <search id="Global_Traffic"> <query>index=xyz_firewall sourcetype=xyz_log policy_name="XYZ" direction=inbound |fields Country,src_ip,vendor_action,dest_ip,dest_port, src_port |iplocation src_ip |search Country=* [|inputlookup XYZ_Country_Block_List] </query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> <fieldset submitButton="true"> <input type="time" token="field1"> <label>Choose Time then Click Submit</label> <default> <earliest>-1m</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <title>GLOBAL DROPS</title> <map> <title>ACTION: Drop</title> <search base="Global_Traffic"> <query>|Search vendor_action IN (Drop, Deny, Block, Reject) |geostats count by Country globallimit=0</query> </search> <option name="mapping.type">marker</option> <option name="refresh.display">progressbar</option> </map> </panel>
... View more