topic Re: Why doesn't my XML base search work? in Dashboards & Visualizations

Why doesn't my XML base search work?

varad_joshi — Tue, 26 Dec 2017 12:35:51 GMT

I am playing with my base search and wondering why this is not working for me. My XML is as below. Pretty simple one huh?

So base search is just index=xyz for last 60 minutes. And the data has a field called action. I want timechart on that action.
For result it just shows timechart on just action (NULL) and not all.

If I open the same search in another window, I am getting proper result. Why such behavior?

<dashboard>
  <search id="basesearch">
    <query> index=xyz
     </query>
      <earliest>-60m</earliest>
       <latest>now</latest>  
  </search>
  <row>
    <panel>
      <chart>
        <search base="basesearch">
          <query>stats count by action</query>
        </search>
      </chart>
    </panel>
  </row>
  </dashboard>

PS: If I run stats count instead of timechart then it show No Result found but the same query works well in search.

Re: Why doesn't my XML base search work?

ddrillic — Tue, 26 Dec 2017 15:08:22 GMT

Aren't you missing the pipe at <query>stats count by action</query>?, meaning something like <query>| stats count by action</query>

Re: Why doesn't my XML base search work?

niketn — Tue, 26 Dec 2017 17:07:00 GMT

@varad_joshi, you can try to return specific fields or try | fields * in your base search and then see whether your post-process query picks it up or not. However, you should refer to Post Processing Best Practices that the base search should have a transforming command and you must not try to pass on raw events through the base search (in such cases you might be better off running separate searches instead of post processing).

Check out examples on how you should ideally perform post processing (multiple and multi-level)

   <search id="basesearch">
     <query> index=xyz | fields action
      </query>
       <earliest>-60m</earliest>
        <latest>now</latest>  
   </search>

Re: Why doesn't my XML base search work?

niketn — Tue, 26 Dec 2017 20:17:43 GMT

@ddrillic, I don't think pipe is mandatory for post process searches.

Re: Why doesn't my XML base search work?

ddrillic — Tue, 26 Dec 2017 22:48:28 GMT

Fair enough - thank you @niketnilay.

Re: Why doesn't my XML base search work?

varad_joshi — Thu, 28 Dec 2017 09:11:35 GMT

Thanks Niket.
Yes I figured that later once I posted the question.

Thanks for your answer.