postprocess - dashboard display

[hqw]

Hi all,

I want to use post process to speed up my dashboard, but face some problem to display out my result in the sub search. Can any one kindly tell me what is wrong? why can't i see any data ?

my base search:
<search id="1">
<![CDATA[*** | eval day=strftime(_time, "%Y-%m-%d") | rex field=_raw "server_name\=\"(?<retailer>([a-zA-Z]+)|(\d-\d+\s+))" | stats sum(touch_count) as sum_touch_count by day, retailer]]>

my sub search:
<search base="1">
chart dc(server_name) AS "Distinct_Count_server", sum(sum_touch_count) AS sum_touch_count over day by retailer |eval avg= sum_touch_count/Distinct_Count_server |eval avg=round(avg,0)

what i want is to display average by retailers over time, but currently i just can get the result of server count and sum of interaction count by retail over time. Is there any requirement to add anything else behind my current sub search?

Thanks in advance.

[alacercogitatus · Accepted solution]

The problem is that your subsearch is trying to use fields that are presented from the base search. A stats command will remove the fields presented to the next command, so you are trying to count server_name, but that isn't listed as an output field of the base search. You can try using eventstats to calculate the sum_touch_count.

<search id="1"><query><![CDATA[*** | eval day=strftime(_time, "%Y-%m-%d") | rex field=_raw "server_name\=\"(?<retailer>([a-zA-Z]+)|(\d-\d+\s+))" | eventstats sum(touch_count) as sum_touch_count by day, retailer]]></query></search>

<search base="1><query>chart dc(server_name) AS "Distinct_Count_server", latest(sum_touch_count) AS sum_touch_count over day by retailer |eval avg= sum_touch_count/Distinct_Count_server |eval avg=round(avg,0)