Dashboards & Visualizations

HiddenPostProcess issues

echalex
Builder

I have a problem with using a common search for more tables in a view.

I'm trying to follow the instructions in the documentation.

The issue I have is that I can see now results in my timechart. The singlevalue field, however, IS updated:

<module name="HiddenSearch" layoutPanel="panel_row3_col1" autoRun="True">
<param name="search">index=os sourcetype=vmstat host=problemhost earliest=-4h@h | multikv fields loadAvg1mi, swapUsedPct</param>
<module name="HiddenPostProcess" layoutPanel="panel_row1_col1" group="CPU Load">
<param name="search">| timechart avg(loadAvg1mi) by host</param>
<module name="HiddenChartFormatter">
<param name="charting.axisTitleY.text">Load</param>
<param name="charting.chart">line</param>
<param name="charting.chart.stackMode">default</param>
<param name="charting.legend.placement">none</param>
<param name="charting.primaryAxisTitle.text">time</param>
<param name="charting.chart.nullValueMode">gaps</param>
<param name="charting.chart.showMarkers">false</param>
<param name="charting.layout.splitSeries">false</param>
<module name="JSChart">
<param name="width">100%</param>
</module>
</module>
</module>
<module name="HiddenPostProcess"
layoutPanel="panel_row1_col2" group="SIngle value">
<param name="search">| stats count</param>
<module name="SingleValue">
<param name="field">count</param>
<param name="afterLabel"> events</param>
<param name="classField">range</param>
</module>

</module>

0 Karma
1 Solution

echalex
Builder

Actually, I found out one workaround solution for this. Apparently, there is only an issue with multikv-extracted values. So, I appended an eval to the base search:

<param name="search">index=os sourcetype=vmstat host=problemhost earliest=-4h@h | multikv fields loadAvg1mi, swapUsedPct |eval load_average=loadAvg1mi</param>

...and did the timechart on the eval'd values:

<param name="search">| timechart avg(load_average) by host</param>

View solution in original post

0 Karma

echalex
Builder

Actually, I found out one workaround solution for this. Apparently, there is only an issue with multikv-extracted values. So, I appended an eval to the base search:

<param name="search">index=os sourcetype=vmstat host=problemhost earliest=-4h@h | multikv fields loadAvg1mi, swapUsedPct |eval load_average=loadAvg1mi</param>

...and did the timechart on the eval'd values:

<param name="search">| timechart avg(load_average) by host</param>
0 Karma

echalex
Builder

I've left out one chart to keep it as simple as possible.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...