Hi All,
I'm looking to create a dynamic dashboard where the search results get updated by way of a Drop-down selector that changes the parameter of the hostname field within all panels.
I've managed to create this setup and I'm in the process of tweaking it a little to be more specific.
However, i found an issue with NOT Operators and Pivots that is giving me problems and which seems to work fine with search.
Essentially, the drop-down selector will allow a user to select a "site". The site selected changes the search to search for hosts beginning with the "unique" ID for that site. For example Li* for Liverpool or Lo* for London.
This works really well, however on one site, they aren't as unique as they should be so, as an example, Li* is also picking up Livermore which i want to exclude.
Now i know in the example above i could just do Liverp* but this is an example and its a bit more complicated than that in real life.
Essentially what i wish to do is
Li* NOT Liverm*
So that i see everything beginning with Li* except Liverm*
In my drop-down selector, under static options, i specify Liverpool as Li* NOT Liverm* and make the token SitetoGet
Within the search i have:
sourcetype=syslog host=$SitetoGet$
And this works very well. The problem comes with Pivots when i apply a FILTER
If i run a picot and filter it as follows:-
FILTER host is $SitetoGet$
I get
Error in PivotCell the Object 'Example_Object' has no field 'NOT'.
Any suggestions as to how i can get around this issue? i have also tried the ! operator with no success.
Thanks
... View more