The index query is runs from base query and i want to append saved search to base query.
saved search is just filtration query. since i have many panels with from same index i tried to use it.
pls give suggestion if any available.
index="******" host="****" source="Perfmon" counter="Available MBytes" sourcetype="Available_Memory" | savedsearch Prem_test
it throws below error :
Error in 'SearchParser': The savedsearch command can only be used as the first command on a search
savedsearch query "| eval Value=round(Value/1024,1) | timechart span=1h eval(round(avg(Value),2)) As "Available""
↧