|
I created a Dashboard from following search sourcetype="TAFC_LOG_LINE" MANAGER | table _time _raw TransactionUUID | rename TransactionUUID as UUID | streamstats range(_time) as Duration by UUID | where Duration > 0.0 Now in Dashboard there is two option UUID Duration When I click on duration I got above error with below message PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'streamstats' command Here is the XML for Dashboard <?xml version='1.0' encoding='utf-8'?> <dashboard> <label>UUID Chart</label> <row> <chart> <searchname>UUID</searchname> <title>UUID</title> <option name="charting.chart">line</option> </chart> </row> </dashboard> |
2 Answers:
Any update regarding my question?
Just putting this as a comment because it's not really an answer, but I suspect your problems might have something common with this: http://splunk-base.splunk.com/answers/6076/parser-error-on-drilldown-when-using-table