If I combine my Base Search + secondary search I see the result but with following code - my TimeChart has no results.
Post process examples
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
<param name="actionsMenuFilter">dashboard</param>
<param name="search">
index=summary search_name="PerfStats-5min-Summary"
(osType="mac" OR osType="os x" OR osType="windows" OR osType="linux") |
regex url="_sample\.html?"
</param>
<module name="HiddenPostProcess" layoutPanel="panel_row1_col1"
group="Post process as single value">
<param name="search">
| stats count
</param>
<module name="SingleValue">
<param name="field">count</param>
<param name="afterLabel"> events</param>
<param name="classField">range</param>
</module>
</module>
<module name="HiddenPostProcess"
layoutPanel="panel_row1_col2" group="Post process as Line Chart">
<param name="search">
| where vendor=“oo" | timechart count by event9
</param>
<module name="HiddenChartFormatter">
<param name="chart">line</param>
<param name=“chartTitle">Count By Event</param>
<param name="primaryAxisTitle.text">time</param>
<param name="secondaryAxisTitle.text">Average Runtime</param>
<param name="legend.placement">right</param>
<module name="JSChart">
<param name="width">100%</param>
<param name="height">350px</param>
</module>
</module>
</module>
Found the issue - The problem is to have your fields available in PostProcess you need to add field * to have them available in child search.
Found the issue - The problem is to have your fields available in PostProcess you need to add field * to have them available in child search.
Your search with timechart no run because it ils "unbalanced quotes"
Where vendor="00".
|where vendor="00"|timechart count by event9
Sorry what do you mean unbalanced quotes? Could you please explain in details.