I have customized the Windows App to send perfmon and windows events to separate indices (named perfmon and winevents, respectively). As such, the "All Indexed Data" dashboard at the bottom of the Windows_App_Info ("Overview") page no longer renders the information correctly.
I dove into the XML and tried to re-arrange the search, but had little success with this. It seems to be bound to constraints I am not terribly familiar with (a bit of a novice here). For example, the search to render the "Sources" column is: | metadata type=sources (eventtype="windows_performance" OR eventtype="windows_events") (...etc...). The relevant eventtype definitions have been updated to specify the relevant custom index, and work in normal searches, though not in this particular lookup. On top of that, I can retrieve data if I specify index=*, though this is not exactly what I want. If I change the search to specify (index=winevents OR index=perfmon) in place of the eventtypes parameters, it produces 0 results.
Am I only allowed to specify one index here? Has anyone had any luck getting this to dashboard to render using custom indices?