DX SaaS Dashboard queries throw errors or return incorrect results when using lowercase boolean operators

Products

• DX SaaS
• DX Operational Intelligence
• DX Operational Observability
• DX OI SaaS

Issue/Introduction

Symptoms

• DX SaaS Dashboards or Stat visualizations fail to load or throw syntax errors.
• Dashboards that previously functioned correctly suddenly trigger application alerts or "panic" states.
• Query filters appear to ignore certain criteria, leading to the display of incorrect alarm data.
• Changing a lowercase operator (e.g., or) to uppercase (e.g., OR) immediately resolves the error and restores correct data visualization.

Environment

 

• Product: DX SaaS (Operational Intelligence / Digital Operational Observability)
• Component: Dashboards and Visualizations

 

Cause

DX SaaS dashboards utilize the Apache Lucene search library for query parsing. According to the official Apache Lucene query parser syntax, boolean operators (AND, OR, NOT) must be all uppercase.

While lowercase operators may work inconsistently in certain contexts or older versions, this behavior is considered "undefined." Updates to the SaaS environment (including security patches or vulnerability fixes) can cause the parser to strictly adhere to the documented standard, resulting in lowercase operators being treated as literal text or ignored entirely.

Resolution

To ensure query stability and accuracy, all logical operators must be written in uppercase.

1. Open the affected Dashboard or Visualization.
2. Locate the query string in the Data Source or Filter settings.
3. Replace all lowercase boolean operators with their uppercase equivalents:
   • Change or to OR
   • Change and to AND
   • Change not to NOT
4. Save the changes and refresh the dashboard to verify the fix.

Example of Correct Syntax: (alarm_name:myalarm1 OR alarm_name:myalarm2) AND status:new

---

Additional Information

For further details on supported query syntax, please refer to the Official Apache Lucene Documentation.