Dashboards & Visualizations

Post processing using transforming command

chetan1974
Engager

While using post process, I have set base search as "index=_test source="/logs/trans.log" component=core|fields activity". In my post process query, using below search

timechart span=1h count(activity) as Activites

In my base query, there is no transforming command. When I try to use transforming command like timechart or stats, I do not get any results back.

How do I use transforming command to link base search and post process query?

0 Karma

woodcock
Esteemed Legend

I am assuming that you are doing various kinds of timecharts for the post-process. If so check out my accepted answer here for the optimal approach:
https://answers.splunk.com/answers/541378/how-to-create-a-base-search-that-retains-multiple.html

0 Karma

cmerriman
Super Champion

In your base search use | fields _time activity
so that your post process can see _time for the timechart. You'll need to bring forward any interesting field in the fields command in your base search for any post process search.

gcusello
SplunkTrust
SplunkTrust

Hi chetan1974,
there is no problem to put transform command both in the base search and/or in one or more of the secondary searches.
The only attention point is to insert all the fields that you have in the secondary searches in the "field" command that is at the end of the base search.
Bye.
Giuseppe

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Did you try using the leading pipe? |stats etc.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...