https://community.splunk.com/t5/Splunk-Search/How-to-convert-base-search-query-that-uses-stats-into-a/m-p/475924#M133722 <P>Hi, I've swapped the base search and post-processing search and changed it to eventstats but then the base search will not display a chart since we can pick the visualization for stats but not eventstats?</P> <P>Basically, I need the base query to display a pie chart from <STRONG>stats count by cs_host</STRONG> and the post search query to display a timechart. <STRONG>Timechart span=1h count(orderID) as Number_of_Orders</STRONG></P> Wed, 30 Sep 2020 02:11:00 GMT lsy9891 2020-09-30T02:11:00Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-base-search-query-that-uses-stats-into-a/m-p/475922#M133720 <P>Hi, I want to display this query in my dashboard in two different charts.</P> <P>So this is my base search query:<BR /> search base="OrderSearch"</P> <PRE><CODE>host=NETWEBA* sourcetype=iis NOT("ErrorGuid") (sc_status="2**" OR sc_status="3**") "GET" | rex field=cs_referer "https:\/\/[a-zA-Z]+\.[a-zA-Z]+\.([a-zA-Z]+|[a-zA-Z]+.[a-zA-Z]+)\/order20\/order\/confirmation-v2\/(?&lt;orderID&gt;[0-9]+)(.*)" | dedup orderID |stats count by cs_host </CODE></PRE> <P>Then I want to display this in a different timechart:</P> <P>search id="OrderSearch"</P> <PRE><CODE>timechart span=1h count(orderID) as Number_of_Orders </CODE></PRE> <P>I tried changing it to eventstats but it didn't work?</P> Thu, 12 Sep 2019 07:25:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-base-search-query-that-uses-stats-into-a/m-p/475922#M133720 lsy9891 2019-09-12T07:25:20Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-base-search-query-that-uses-stats-into-a/m-p/475923#M133721 <P>You have your search tags reversed. The base search should use<CODE>id="OrderSearch"</CODE> and the post-processing search should use <CODE>base="OrderSearch"</CODE>.</P> <P>That said, the <CODE>timesearch</CODE> fails because it needs _time and orderID fields, neither of which come out of the base search because <CODE>stats</CODE> filters fields to those explicitly mentioned. <CODE>eventstats</CODE> should fix that once the fix above is implemented.</P> Thu, 12 Sep 2019 12:14:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-base-search-query-that-uses-stats-into-a/m-p/475923#M133721 richgalloway 2019-09-12T12:14:13Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-base-search-query-that-uses-stats-into-a/m-p/475924#M133722 <P>Hi, I've swapped the base search and post-processing search and changed it to eventstats but then the base search will not display a chart since we can pick the visualization for stats but not eventstats?</P> <P>Basically, I need the base query to display a pie chart from <STRONG>stats count by cs_host</STRONG> and the post search query to display a timechart. <STRONG>Timechart span=1h count(orderID) as Number_of_Orders</STRONG></P> Wed, 30 Sep 2020 02:11:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-base-search-query-that-uses-stats-into-a/m-p/475924#M133722 lsy9891 2020-09-30T02:11:00Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-base-search-query-that-uses-stats-into-a/m-p/475925#M133723 <P>Base searches should not create visualizations. Do the visualization in post-processing.</P> Wed, 18 Sep 2019 12:54:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-base-search-query-that-uses-stats-into-a/m-p/475925#M133723 richgalloway 2019-09-18T12:54:44Z