I have a dashboard that uses HiddenSearch and HiddenPostProcess to show 4 line charts. The first two look at 3 monthes worth of events and show the avg and min of a field respectively. The last 2 charts should show 1 monthes worth of data for the same two statistics. I was hoping I could run the HiddenSearch for three monthes worth of data and then have the two 1 month HiddenPostProcess do something like this:
<module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
<param name="search"> sourcetype=perfdata End | fields _time, runtime, class</param>
<param name="earliest">-2160h</param>
<module name="HiddenPostProcess" layoutPanel="panel_row1_col1">
<param name="search">search earlist=-720h | timechart avg(runtime) by class</param>
<module name="HiddenChartFormatter">
<param name="chart">line</param>
<param name="chartTitle">Average Runtime 1 Month</param>
<param name="primaryAxisTitle.text">time</param>
<param name="secondaryAxisTitle.text">Average Runtime</param>
<param name="legend.placement">right</param>
<module name="FlashChart">
<param name="width">100%</param>
<param name="height">350px</param>
</module>
</module>
</module>
This does not appear to work. Is this possible, or do I need to run a hiddensearch for each timerange?
... View more