Hi all,
I recently converted from 4.0.x to 4.1.5, and I found that all of my views broke. The searches still run, and state they have results, but not all the existing fields come through, so the data that is post-processed does not display properly.
Here is an example search for a person input into a form (if the field is not null):
index=my_index "searchstring" [ stats count | eval search=if("$Person$"=="NOTSPECIFIED"," ","user=$Person$ ") | fields - count ]
This used to search for a variable the user input in a form, and output the results with all fields intact. Now, only two or three of 40 some-odd resulting fields show up if I remove post process on the results. I've tried specifying all necessary fields in the search to no avail.
My search post processes are pretty basic, just "top" and "dedup" or specifying fields.
<table>
<title>Top Users</title>
<searchPostProcess> | top user limit=10</searchPostProcess>
</table>
Thank you kindly for your time.
... View more