Hi,
I have the following code for post process search but it does not show me results.
<dashboard>
<label>id_base</label>
<search id="base1">
<query> index=_internal source="*" sourcetype=splunkd_access</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<fieldset submitButton="false">
<input type="time" token="field1">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<chart>
<search base="base1">
<query> stats count by method</query>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
</row>
</dashboard>
Could you help me?, please.
Regards.
Line 22 needs a pipe proceeding the search like this.. Best way to troubleshoot this is to click the search icon and open the search in a new window to see the query strung together
<dashboard>
<label>id_base</label>
<search id="base1">
<query> index=_internal source="*" sourcetype=splunkd_access</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<fieldset submitButton="false">
<input type="time" token="field1">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<chart>
<search base="base1">
<query>| stats count by method</query>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
@Carolina
As a performance point of view, I would suggest you mention field names in base search, It will solve your this issue also.
<search id="base1">
<query> index=_internal source="*" sourcetype=splunkd_access | fields method </query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
It would not solve the problem since OP does not have a pipe in his post process search. It's also best practice to use a reporting command in the base search
Line 22 needs a pipe proceeding the search like this.. Best way to troubleshoot this is to click the search icon and open the search in a new window to see the query strung together
<dashboard>
<label>id_base</label>
<search id="base1">
<query> index=_internal source="*" sourcetype=splunkd_access</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<fieldset submitButton="false">
<input type="time" token="field1">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<chart>
<search base="base1">
<query>| stats count by method</query>
</search>
<option name="charting.chart">pie</option>
<option name="charting.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</chart>
</panel>
@Carolina did this solve your issue? Can you accept the answer to close it out?
<query>|stats count by method</query>