topic Re: why splunk doesn't resolve stats count on postprocess ? in Splunk Search

why splunk doesn't resolve stats count on postprocess ?

sfatnass — Fri, 09 Sep 2016 13:47:47 GMT

when i try to run a stats count using postprocess splunk doesn't resolve the query search and i don't know why ?

this is my dashboard :

<form>
  <label>Post Process Search</label>
  <description>Each panel post processes the base search through a separate search pipeline.</description>
  <search id="internal_data">
      <query>index=_internal </query>
  </search>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">
      <default>
        <earliest>0</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
     <table>
      <title>Top Sourcetypes</title>
      <search base="internal_data">
          <query>stats count(uri_path)</query>
      </search>

    </table>
    <chart>
      <title>Events over Time</title>
      <search base="internal_data">
          <query>timechart count</query>
      </search>
      <option name="charting.chart">column</option>
    </chart>

  </row>
</form>

Re: why splunk doesn't resolve stats count on postprocess ?

TStrauch — Tue, 29 Sep 2020 10:55:38 GMT

Hi,

its a little tricky. Splunk runs all Dashboard searches in fast mode. So for your search index=_internal no fields are extracted during search time. This means you cannot do a stats command on "uri_path" because splunk just dont know the field in your postprocess search. just do

"index=_internal | fields *" for your basesearch and it will work.

https://answers.splunk.com/answers/152287/why-search-with-postprocessing-returns-no-results-in-dashboard-but-the-actual-search-does.html

regards

Re: why splunk doesn't resolve stats count on postprocess ?

sfatnass — Fri, 09 Sep 2016 15:41:37 GMT

thx ^^ it worl perfectly

Re: why splunk doesn't resolve stats count on postprocess ?

bmacias84 — Fri, 09 Sep 2016 16:32:05 GMT

Basically you must apply a transforming command in your base search fields, stats, etc. Keep in mind that their is 100,000 event limit when using post process searches.

Re: why splunk doesn't resolve stats count on postprocess ?

sfatnass — Fri, 09 Sep 2016 20:35:53 GMT

but it's possible to extend this limit?

Re: why splunk doesn't resolve stats count on postprocess ?

bmacias84 — Fri, 09 Sep 2016 20:53:55 GMT

Limits are controlled through limits.conf. I've never been able to ID a corresponding setting.