search help, token issue

[selvam_sekar]

Hi,

if i run this query in simple search bar it works fine. However, when i create panel and add the below, i'm getting error as waiting for input.

Please could you advise?

index=hello sourcetype=welcome
| stats max(DATETIME) as LatestTime
| map search="search index=hello sourcetype=welcome DATETIME=$LatestTime$"
| stats sum(HOUSE_TRADE_COUNT) as HOUSE_Trade_Count

Thanks,

selvam.

[selvam_sekar]

Thanks @ITWhisperer .

I also found an issue, if I run this query for yesterday I am getting the result as 44Million count but when I run the search for last 7 days I am getting only 23Million results.

Any suggestion to fix?

index=hello sourcetype=welcome
| stats max(DATETIME) as LatestTime
| map search="search index=hello sourcetype=welcome DATETIME=$$LatestTime$$"
| stats sum(HOUSE_TRADE_COUNT) as HOUSE_Trade_Count

[ITWhisperer]

Suggestion is "don't use map". Map is an expensive, resource intensive, and slow command. Other ways to achieve this might be

index=hello sourcetype=welcome
| eventstats max(DATETIME) as LatestTime
| where DATETIME=LatestTime
| stats sum(HOUSE_TRADE_COUNT) as HOUSE_Trade_Count

[ITWhisperer · Accepted solution]

Try doubling up the $'s as single $ are for tokens in dashboards.

index=hello sourcetype=welcome
| stats max(DATETIME) as LatestTime
| map search="search index=hello sourcetype=welcome DATETIME=$$LatestTime$$"
| stats sum(HOUSE_TRADE_COUNT) as HOUSE_Trade_Count