splunk 6 simplexml searchtemplate not working?

kundeng — Fri, 18 Jul 2014 15:48:19 GMT

Has anybody used the searchTemplate with searchPostProcess with single element? I simply can't get it to work. It always shows 0.

If I run the concatenated search, it works fine. What's wrong? Here is the snippet of the code:

  <searchTemplate>
     <![CDATA[
     sourcetype=sitescope Capsuletech:  host="UHSISMONCPRA*" | regex
source="SiteScope\d{4}_\d{2}_\d{2}(?<!v2)\.log"
 | head 2000 ]]>   </searchTemplate>

inside the "dashboard" element.

Then in a single element, I have

<searchPostProcess>search NOT UHCASSPR* | dedup MonitorName sortby -_time | stats count as total</searchPostProcess>
<field>total </field>

Re: splunk 6 simplexml searchtemplate not working?

MuS — Tue, 16 Dec 2014 10:13:14 GMT

Hi kundeng,

you should use a transforming command within your searchTemplate for best results; read the docs http://docs.splunk.com/Documentation/Splunk/6.2.0/AdvancedDev/PostProcess

cheers, MuS

topic Re: splunk 6 simplexml searchtemplate not working? in Dashboards & Visualizations

splunk 6 simplexml searchtemplate not working?

Re: splunk 6 simplexml searchtemplate not working?