Hello,
I have a search rule that is perfectly working:
.... |
sort - 0 _time |
fields - _* |
fields data1 data 2 data3
I have created a dashboard and integrated the rule.
The result of the rule is wrong and I discovered that the string search had been modified:
**"sort - 0 _time" => "sort-0 _time"** and this command does not work; it does not sort _time in the correct order
"fields - _*" gets " fields-_*" which is not doing the same thing; it does not remove the fields beginning by _
I have done many tests and this is reproductible 100%.
Each time the generation of the dashboard xml code corrupt my search string and I can not create a working dashboard.
Any ideas are welcome
Regards
↧