Splunk Search

HiddenPostProcess - TimeChart - No Result Found

MayankSplunk
Path Finder

If I combine my Base Search + secondary search I see the result but with following code - my TimeChart has no results.

Post process examples

<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>



<param name="actionsMenuFilter">dashboard</param>



<param name="search">
  index=summary search_name="PerfStats-5min-Summary"
  (osType="mac" OR osType="os x" OR osType="windows" OR osType="linux") |
  regex url="_sample\.html?"
</param>

<module name="HiddenPostProcess" layoutPanel="panel_row1_col1"
group="Post process as single value">

  <param name="search">
    | stats count
  </param>

  <module name="SingleValue">
    <param name="field">count</param>
    <param name="afterLabel"> events</param>
    <param name="classField">range</param>
  </module>

</module>    


<module name="HiddenPostProcess"
layoutPanel="panel_row1_col2" group="Post process as Line Chart">

  <param name="search">
    | where vendor=“oo" | timechart  count by event9
  </param>

  <module name="HiddenChartFormatter">
    <param name="chart">line</param>
    <param name=“chartTitle">Count By Event</param>
    <param name="primaryAxisTitle.text">time</param>
    <param name="secondaryAxisTitle.text">Average Runtime</param>
    <param name="legend.placement">right</param>
    <module name="JSChart">
      <param name="width">100%</param>
      <param name="height">350px</param>
    </module>
  </module>


</module>
0 Karma
1 Solution

MayankSplunk
Path Finder

Found the issue - The problem is to have your fields available in PostProcess you need to add field * to have them available in child search.

View solution in original post

MayankSplunk
Path Finder

Found the issue - The problem is to have your fields available in PostProcess you need to add field * to have them available in child search.

fdi01
Motivator

Your search with timechart no run because it ils "unbalanced quotes"
Where vendor="00".
|where vendor="00"|timechart count by event9

0 Karma

MayankSplunk
Path Finder

Sorry what do you mean unbalanced quotes? Could you please explain in details.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...