diff --git a/docs/dashboards/restricted-operators-dashboards.md b/docs/dashboards/restricted-operators-dashboards.md index b2018bdec5..237881f448 100644 --- a/docs/dashboards/restricted-operators-dashboards.md +++ b/docs/dashboards/restricted-operators-dashboards.md @@ -18,32 +18,34 @@ The following operators cannot be used with dashboards: * `Sample` (internal-use operator) * [`Save`](/docs/search/search-query-language/search-operators/save) -## Auto refresh restrictions +## Auto refresh and public dashboard restrictions -The following operators cannot be used in Auto refresh: +* The following operators cannot be used: + * `Compare With` can be used when your query's aggregate operation is grouped by a [timeslice](/docs/search/search-query-language/search-operators/timeslice). + * [`Cat`](/docs/search/search-query-language/search-operators/cat/) + * `Details` + * [`First`, `Last`](/docs/search/search-query-language/group-aggregate-operators/first-last/). Instead use the `withtime` option. See [`most_recent` and `least_recent`](/docs/search/search-query-language/group-aggregate-operators/most-recent-least-recent). + * [`Join`](/docs/search/search-query-language/search-operators/join/) + * [`LogReduce`](/docs/search/behavior-insights/logreduce/logreduce-operator/) + * [`LogCompare`](/docs/search/behavior-insights/logcompare/) + * [`Now`](/docs/search/search-query-language/search-operators/now) + * [`Outlier`](/docs/search/search-query-language/search-operators/outlier/) will omit the first N (window size) data points in results because those data points are used in the training phase. + * `Parse Using` + * [`queryStartTime()`](/docs/search/search-query-language/search-operators/querystarttime) + * [`queryEndTime()`](/docs/search/search-query-language/search-operators/queryendtime) + * [`Save`](/docs/search/search-query-language/search-operators/save/) + * `Sessionize` + * [`Subquery`](/docs/search/subqueries) + * `Threat Intel` + * [`Trace`](/docs/search/search-query-language/search-operators/trace) + * [`Timeslice`](/docs/search/search-query-language/search-operators/timeslice) greater than 1 day. + * [`Transactionize`](/docs/search/search-query-language/transaction-analytics/transactionize-operator/) -* `Compare With` can be used when your query's aggregate operation is grouped by a [timeslice](/docs/search/search-query-language/search-operators/timeslice) -* `Details` -* [`First`, `Last`](/docs/search/search-query-language/group-aggregate-operators/first-last/) - instead use the **withtime** option, see [`most_recent` and `least_recent`](/docs/search/search-query-language/group-aggregate-operators/most-recent-least-recent). -* [`Join`](/docs/search/search-query-language/search-operators/join/) -* [`LogReduce`](/docs/search/behavior-insights/logreduce/logreduce-operator/) -* [`LogCompare`](/docs/search/behavior-insights/logcompare/) -* [`Now`](/docs/search/search-query-language/search-operators/now) -* [`Outlier`](/docs/search/search-query-language/search-operators/outlier/) will omit the first N (window size) data points in results because those data points are used in the training phase. -* `Parse Using` -* [`queryStartTime()`](/docs/search/search-query-language/search-operators/querystarttime) -* [`queryEndTime()`](/docs/search/search-query-language/search-operators/queryendtime) -* [`Save`](/docs/search/search-query-language/search-operators/save/) -* `Sessionize` -* [`Subquery`](/docs/search/subqueries) -* `Threat Intel` -* [`Trace`](/docs/search/search-query-language/search-operators/trace) -* [`Timeslice`](/docs/search/search-query-language/search-operators/timeslice) greater than 1 day -* [`Transactionize`](/docs/search/search-query-language/transaction-analytics/transactionize-operator/) - -The following search modifier cannot be used in Auto refresh. +* The following search modifier cannot be used. + * `_dataTier` -* `_dataTier` +* [Receipt time searches](/docs/search/get-started-with-search/build-search/use-receipt-time) are not supported. +* Only [relative time ranges](/docs/search/get-started-with-search/search-basics/time-range-expressions/#relative-time-range-expressions) are supported. [Absolute time ranges](/docs/search/get-started-with-search/search-basics/time-range-expressions/#absolute-time-range-expressions) with custom end times are not supported. ## Include only after the first group-by phrase