topic Re: How come the following code for a post process search in a dashboard is not returning results? in Dashboards & Visualizations

How come the following code for a post process search in a dashboard is not returning results?

Carolina — Tue, 20 Nov 2018 02:38:48 GMT

Hi,

I have the following code for post process search but it does not show me results.

<dashboard>
  <label>id_base</label>
      <search id="base1">
    <query> index=_internal source="*" sourcetype=splunkd_access</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>

</search>
  <fieldset submitButton="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search base="base1">
          <query> stats count by method</query>

        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</dashboard>

Could you help me?, please.

Regards.

Re: How come the following code for a post process search in a dashboard is not returning results?

akemko — Tue, 20 Nov 2018 03:00:44 GMT

<query>|stats count by method</query>

Re: How come the following code for a post process search in a dashboard is not returning results?

skoelpin — Tue, 20 Nov 2018 03:29:22 GMT

Line 22 needs a pipe proceeding the search like this.. Best way to troubleshoot this is to click the search icon and open the search in a new window to see the query strung together

<dashboard>
   <label>id_base</label>
       <search id="base1">
     <query> index=_internal source="*" sourcetype=splunkd_access</query>
           <earliest>$field1.earliest$</earliest>
           <latest>$field1.latest$</latest>

 </search>
   <fieldset submitButton="false">
     <input type="time" token="field1">
       <label></label>
       <default>
         <earliest>-24h@h</earliest>
         <latest>now</latest>
       </default>
     </input>
   </fieldset>
   <row>
     <panel>
       <chart>
         <search base="base1">
           <query>| stats count by method</query>

         </search>
         <option name="charting.chart">pie</option>
         <option name="charting.drilldown">none</option>
         <option name="refresh.display">progressbar</option>
       </chart>
     </panel>

Re: How come the following code for a post process search in a dashboard is not returning results?

kamlesh_vaghela — Tue, 20 Nov 2018 05:37:32 GMT

@Carolina
As a performance point of view, I would suggest you mention field names in base search, It will solve your this issue also.

<search id="base1">
     <query> index=_internal source="*" sourcetype=splunkd_access | fields method </query>
           <earliest>$field1.earliest$</earliest>
           <latest>$field1.latest$</latest>
 </search>

Re: How come the following code for a post process search in a dashboard is not returning results?

skoelpin — Tue, 20 Nov 2018 14:53:50 GMT

It would not solve the problem since OP does not have a pipe in his post process search. It's also best practice to use a reporting command in the base search

Re: How come the following code for a post process search in a dashboard is not returning results?

skoelpin — Thu, 29 Nov 2018 14:48:56 GMT

@Carolina did this solve your issue? Can you accept the answer to close it out?