Splunk Search

How do I do Field (column) selection for post process search in a dashboard panel?

uksysadmins
New Member

In a dashboard I'm trying to drive several charts off a single query and use post process search to select the fields that I want.
The timechart has a "by" clause and I wanted to select fields (columns in this case) for each chart based on the prefix which is the by field followed by a "-".
Assuming the by field is an "a" or a "b" I end up with fields like - _time, a-avgcpu,a-maxcpu,b-avgcpu,b-maxcpu
I wanted to chart them separately
So I tried <query> | fields _time,a-* and <query> | fields _time,b-*
For all the charts they just come up empty. Tried the equivalent search outside the dashboard app and it only displays the _time field.

Does using the by clause change something fundamental that I've missed to do with result names...is there another way to do this? ( I see from another question that it appears to be possible if there is no by clause, although they are also not using a wild card field selection in that question either)

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You'll want your base search to end with | timechart something by something, and each postprocess search to be | fields _* a-*. Make sure your field names after the timechart match exactly to the fields.
There's a little bit of magic hidden in fields like _span to drive timechart-specific rendering, such as the fancy date axis.

For a nicer way, consider this:

base search:
... | bin _time | stats avg(something) as avgsomething by _time splitfield
post process 1:
| search splitfield=a | fields - splitfield | timechart values(*) as *
post process 2:
| search splitfield=b | fields - splitfield | timechart values(*) as *

In general, you'll want to only use timechart at the end and stick to bin|stats for intermediate steps. That way you don't end up with very wide tables and dynamic/unknown field names caused by the split-by field.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...