topic Re: Post processing using transforming command in Dashboards & Visualizations

Post processing using transforming command

chetan1974 — Fri, 04 Aug 2017 21:47:45 GMT

While using post process, I have set base search as "index=_test source="/logs/trans.log" component=core|fields activity". In my post process query, using below search

timechart span=1h count(activity) as Activites

In my base query, there is no transforming command. When I try to use transforming command like timechart or stats, I do not get any results back.

How do I use transforming command to link base search and post process query?

Re: Post processing using transforming command

DalJeanis — Sat, 05 Aug 2017 01:06:28 GMT

Did you try using the leading pipe? |stats etc.

Re: Post processing using transforming command

gcusello — Sat, 05 Aug 2017 07:58:21 GMT

Hi chetan1974,
there is no problem to put transform command both in the base search and/or in one or more of the secondary searches.
The only attention point is to insert all the fields that you have in the secondary searches in the "field" command that is at the end of the base search.
Bye.
Giuseppe

Re: Post processing using transforming command

cmerriman — Sat, 05 Aug 2017 10:55:37 GMT

In your base search use | fields _time activity
so that your post process can see _time for the timechart. You'll need to bring forward any interesting field in the fields command in your base search for any post process search.

Re: Post processing using transforming command

woodcock — Mon, 07 Aug 2017 22:32:43 GMT

I am assuming that you are doing various kinds of timecharts for the post-process. If so check out my accepted answer here for the optimal approach:
https://answers.splunk.com/answers/541378/how-to-create-a-base-search-that-retains-multiple.html