Hi,
I am creating the dashboard, where for couple of panels I will use similar query so I saved shared bit as base query. However I have 2 different indexes (environments) so I also created input to choose appropriate index for the base search. However it looks like it picks up just prod, and not returning results for ppe.
Can someone please help me to understand what is wrong with my code?
"dataSources": {
"ds_baseSearch": {
"type": "ds.search",
"options": {
"query": "index=\"$env$\" sourcetype=some_sourcetype risk=*\n| spath risk\n| rename risk AS risk\n| eval riskCategory = if(risk <= 1.0, \"low\", if(risk<= 2.0, \"moderate\", \"high\"))\n| stats count(eval(riskCategory==\"low\")) as low, count(eval(riskCategory==\"moderate\")) as moderate, count(eval(riskCategory==\"high\")) as high, count as total\n ",
"queryParameters": {
"earliest": "$time.earliest$",
"latest": "$time.latest$"
},
"enableSmartSources": true
},
"name": "base_search"
},
"ds_search_2": {
"type": "ds.chain",
"options": {
"query": "| stats sum(total) as Total ",
"extend": "ds_baseSearch"
},
"name": "_total"
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {}
}
}
}
},
"inputs": {
"input_2": {
"type": "input.timerange",
"title": "Time period",
"options": {
"token": "time",
"defaultValue": "-60m@m,now"
}
},
"input_hw3xXSsR": {
"options": {
"items": [
{
"label": "prod",
"value": "_prod"
},
{
"label": "ppe",
"value": "_ppe"
}
],
"token": "evn",
"defaultValue": "_prod"
},
"title": "Environment",
"type": "input.dropdown",
"dataSources": {}
}
},
... View more