topic Re: Why are 2 of my 3 HiddenPostProcess searches returning zero results? in Splunk Search

Why are 2 of my 3 HiddenPostProcess searches returning zero results?

luxiaobin — Wed, 04 Feb 2015 00:11:42 GMT

Hi, I'm using HiddenPostProcess. I made three HiddenPostProcess searches. The first returns the right number, but the others return 0. Can someone tell me what's wrong with my search? thx!

    <param name="search">index=idx_source=*xx*|where strftime(strptime(REGIST_TIME,"%s"),"%Y") = strftime(now(),"%Y")|where strftime(strptime(REGIST_TIME,"%s"),"%m") = strftime(now(),"%m")</param>
    <module name="HiddenPostProcess">
        <param name="search">|stats count</param>
        <module name="SingleValue">
            <param name="beforeLabel">共</param>
            <param name="format">number</param>
            <param name="afterLabel">人</param>
        </module>
    </module>
    <module name="HiddenPostProcess">
        <param name="search">|where GENDER=1|stats count</param>
        <module name="SingleValue">
            <param name="beforeLabel">女</param>
            <param name="format">number</param>
            <param name="afterLabel">人</param>
        </module>
    </module>
    <module name="HiddenPostProcess">
        <param name="search">|where GENDER=0|stats count</param>
        <module name="SingleValue">
            <param name="beforeLabel">男</param>
            <param name="format">number</param>
            <param name="afterLabel">人</param>
        </module>
    </module>
</module>

Re: Why are 2 of my 3 HiddenPostProcess searches returning zero results?

ramdaspr — Wed, 04 Feb 2015 00:32:22 GMT

I havent tried HiddenPostProcess in a module yet, so this is just a guess. Try using search instead of where

 <module name="HiddenPostProcess">
         <param name="search">| search GENDER=1|stats count</param>

Re: Why are 2 of my 3 HiddenPostProcess searches returning zero results?

luxiaobin — Wed, 04 Feb 2015 13:59:14 GMT

it doesn`t work . anyway thx!

Re: Why are 2 of my 3 HiddenPostProcess searches returning zero results?

DavidHourani — Wed, 04 Feb 2015 14:22:30 GMT

Are you sure you have the field GENDER ? if so, why not do a |stats count by GENDER just to be sure that you actually have something...Do that in the search that is working, then add |search GENDER=0to see what you get 🙂

Re: Why are 2 of my 3 HiddenPostProcess searches returning zero results?

luxiaobin — Wed, 04 Feb 2015 14:28:16 GMT

I find the solution from here http://answers.splunk.com/answers/36752/hiddenpostprocess.html