This page has information about restrictions and rules about using Sumo Logic log search operators with dashboards.
The following operators cannot be used with dashboards:
Auto refresh restrictions
The following operators cannot be used in Auto refresh:
Compare Withcan be used when your query's aggregate operation is grouped by a timeslice
Last- instead use the withtime option, see
Outlierwill omit the first N (window size) data points in results because those data points are used in the training phase.
Timeslicegreater than 1 day
The following search modifier cannot be used in Auto refresh.
Include only after the first group-by phrase
You can use the following operators in dashboard panels:
| timeslice 1d
| count by _timeslice
| sort by _timeslice asc
| accum _count as running_total
You can use the
count_frequent operator in dashboard queries, but the number of results returned is limited to the top 100 most frequent results. All results are available when the search is run on the Search page, but only the top 100 are displayed in the Panel.