Hi, I'm using HiddenPostProcess. I made three HiddenPostProcess searches. The first returns the right number, but the others return 0. Can someone tell me what's wrong with my search? thx!
<param name="search">index=idx_source=*xx*|where strftime(strptime(REGIST_TIME,"%s"),"%Y") = strftime(now(),"%Y")|where strftime(strptime(REGIST_TIME,"%s"),"%m") = strftime(now(),"%m")</param>
<module name="HiddenPostProcess">
<param name="search">|stats count</param>
<module name="SingleValue">
<param name="beforeLabel">共</param>
<param name="format">number</param>
<param name="afterLabel">人</param>
</module>
</module>
<module name="HiddenPostProcess">
<param name="search">|where GENDER=1|stats count</param>
<module name="SingleValue">
<param name="beforeLabel">女</param>
<param name="format">number</param>
<param name="afterLabel">人</param>
</module>
</module>
<module name="HiddenPostProcess">
<param name="search">|where GENDER=0|stats count</param>
<module name="SingleValue">
<param name="beforeLabel">男</param>
<param name="format">number</param>
<param name="afterLabel">人</param>
</module>
</module>
</module>
Are you sure you have the field GENDER ? if so, why not do a |stats count by GENDER
just to be sure that you actually have something...Do that in the search that is working, then add |search GENDER=0
to see what you get 🙂
I havent tried HiddenPostProcess in a module yet, so this is just a guess. Try using search instead of where
<module name="HiddenPostProcess">
<param name="search">| search GENDER=1|stats count</param>
it doesn`t work . anyway thx!