Hello,
I need help on post process,
Here are my queries:
sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX OPERATION="*" | timechart span=1d count by OPERATION
sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX OPERATION="XXXXXX" | timechart span=30M avg(xxxxxx)
sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX OPERATION="YYYYY" | timechart span=30M avg(xxxxxx)
sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX OPERATION="zzzzz" | timechart span=30M avg(xxxxxx)
**I updated my dashboard and I used the post process**
Here is my base query:
sourcetype="xxxx" SERVER_POD="XXXX" FLOW_NAME="XXXXXX" SERVICE_NAME=XXXX ENDPOINT_TYPE=XXXX | fields *
Sub Queries:
1. |timechart span=1d count by OPERATION
2. |search OPERATION="XXXXXX" | timechart span=30M avg(xxxxxx)
3. |search OPERATION="YYYYY" | timechart span=30M avg(xxxxxx)
4. |search OPERATION="zzzzz" | timechart span=30M avg(xxxxxx)
All dashboard panels are working are working fine except 1st one. In the dashboard 1st panel I'm seeing results but there is a warning message saying that "search generated too much data for the current display configuration, results have been truncated."
How to fix this issue? Can I send limited COUNT and AVG data to subqueries(1st panel)?
↧