Hi all,
I've created a dashboard that has multiple panels using essentially the same search, so I decided to try using a base search to cut down on resource usage. Unfortunately I've noticed that when using the base search with `geostats` in the post process search, the results don't match compared with using the whole search in the map panel. If I click on the magnifying glass on the map panel and open it in search, it works as expected again as it's used the base search + the post process search to re-create the whole search.
Any ideas what might be causing this or how I can adjust my base search to fix it?
Here's the (sanitised) code for base search and post process search map panel:
**Base search:**
index=* sourcetype="source1"
| transaction user_id maxspan=1s
| iplocation c_ip
| where field_1 NOT null $field1.earliest$ $field1.latest$
**Post process search:**geostats latfield=lat, longfield=lon count by City globallimit=0
Any guidance would be appreciated.
Thanks,
Ted
Edited to add: The base search is working exactly as expected on other panels that display a table of results or a single value (using stats count).
↧