Splunk Search

HiddenPostProcess - TimeChart - No Result Found

MayankSplunk
Path Finder

If I combine my Base Search + secondary search I see the result but with following code - my TimeChart has no results.

Post process examples

<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>



<param name="actionsMenuFilter">dashboard</param>



<param name="search">
  index=summary search_name="PerfStats-5min-Summary"
  (osType="mac" OR osType="os x" OR osType="windows" OR osType="linux") |
  regex url="_sample\.html?"
</param>

<module name="HiddenPostProcess" layoutPanel="panel_row1_col1"
group="Post process as single value">

  <param name="search">
    | stats count
  </param>

  <module name="SingleValue">
    <param name="field">count</param>
    <param name="afterLabel"> events</param>
    <param name="classField">range</param>
  </module>

</module>    


<module name="HiddenPostProcess"
layoutPanel="panel_row1_col2" group="Post process as Line Chart">

  <param name="search">
    | where vendor=“oo" | timechart  count by event9
  </param>

  <module name="HiddenChartFormatter">
    <param name="chart">line</param>
    <param name=“chartTitle">Count By Event</param>
    <param name="primaryAxisTitle.text">time</param>
    <param name="secondaryAxisTitle.text">Average Runtime</param>
    <param name="legend.placement">right</param>
    <module name="JSChart">
      <param name="width">100%</param>
      <param name="height">350px</param>
    </module>
  </module>


</module>
0 Karma
1 Solution

MayankSplunk
Path Finder

Found the issue - The problem is to have your fields available in PostProcess you need to add field * to have them available in child search.

View solution in original post

MayankSplunk
Path Finder

Found the issue - The problem is to have your fields available in PostProcess you need to add field * to have them available in child search.

fdi01
Motivator

Your search with timechart no run because it ils "unbalanced quotes"
Where vendor="00".
|where vendor="00"|timechart count by event9

0 Karma

MayankSplunk
Path Finder

Sorry what do you mean unbalanced quotes? Could you please explain in details.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...