I have a configuration with two lookups on the same source of data. One lookup associates a numeric field, AccountID, with a two letter CHAINCODE. The second lookup associates the CHAINCODE with a CHAINNAME, which is a string of arbitrary length.
I then have a search that looks like this:
host=*prod* sourcetype="statslog" getsingleavailability | chart count, avg(exec_time) as avg_exec by CHAINNAME | eval round_exec=round(avg_exec) | fields CHAINNAME, count, round_exec | sort - round_exec | rename ACCT_NAME as Hotel, round_exec as "Average Avail Response Time (ms)", count as Transactions, CHAINNAME as Chain
When I run this search from the toolbar or as a saved search, realtime results are displayed as expected.
If I add a panel containing this realtime saved search to a simple dashboard, the results panel never gets past "Waiting for search preview results".
If I modify the search so it charts by CHAINCODE (from the first lookup) instead of CHANNAME (from the second), results do get displayed in the realtime dashboard view.
... View more