topic Example: Simple XML using PostProcess? in Dashboards & Visualizations

Example: Simple XML using PostProcess?

the_wolverine — Tue, 03 Mar 2015 04:24:55 GMT

Can someone post a simple example? The documentation uses Advanced XML as the example: http://docs.splunk.com/Documentation/Splunk/6.0.5/AdvancedDev/PostProcess

Re: Example: Simple XML using PostProcess?

Raghav2384 — Tue, 03 Mar 2015 04:54:40 GMT

Hey, here's a simple syntax

<!-- My parent search -->
<search id="xyz">
  <query>.....|stats count by a,b,c,d,e,f,_time</query>
</search>
<!-- post processing reference -->
<chart>
  <search base="xyz">
    <query> timechart count by a span=15m</query>
  </search>
</chart>
<chart>
  <search base="xyz">
    <query>chart count over a by b</query>
  </search>
</chart>

Hope this helps!

Re: Example: Simple XML using PostProcess?

s2_splunk — Tue, 03 Mar 2015 05:30:01 GMT

From the Splunk 6.x Dashboard Examples app here:

<form>
  <label>Post Process Search</label>
  <description>Each panel post processes the base search through a separate search pipeline.</description>
  <searchTemplate>index=_internal | head 1000</searchTemplate>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">
      <default>
        <earliestTime>-24h</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <chart>
      <title>Events over Time</title>
      <searchPostProcess>timechart count</searchPostProcess>
      <option name="charting.chart">column</option>
    </chart>
    <table>
      <title>Top Sourcetypes</title>
      <searchPostProcess>top limit=100 sourcetype | eval percent = round(percent,2)</searchPostProcess>
      <option name="displayRowNumbers">true</option>
    </table>
  </row>
</form>

Re: Example: Simple XML using PostProcess?

skawasaki_splun — Thu, 25 Jun 2015 18:36:08 GMT

FYI this is the syntax for Splunk 6.0 and 6.1, which only allowed one base search. Splunk 6.2 allows multiple base search (distinguished by ids).

Re: Example: Simple XML using PostProcess?

the_wolverine — Thu, 14 Apr 2016 22:20:14 GMT

FYI: This syntax is only supported in Splunk 6.2+

Re: Example: Simple XML using PostProcess?

androchentw — Thu, 26 Oct 2017 07:42:44 GMT

FYI: Multiple base searches is supported in Splunk 6.2+, and the example of official document is at Dashboards and Visualizations - Searches power dashboards and forms

link doesn't seem to work so I'll just put it here

1: https://answers.splunk.com/answers/239159/multiple-base-searches-in-a-dasboard-with-post-pro.html

2: http://docs.splunk.com/Documentation/Splunk/6.2.5/Viz/Savedsearches#Post-process_examples

Re: Example: Simple XML using PostProcess?

raj_mpl — Mon, 01 Oct 2018 10:09:19 GMT

with global and local time inputs the post processing mechanism not working .. why ?