Charts not populating after post processing is done.

[theouhuios]

Hello

I am completely new to the post processing concept hence having few issues with coding it in xml

`<?xml version='1.0' encoding='utf-8'?>

Incident count

<![CDATA[index="main" sourcetype="incident" |dedup record.incidentId| stats count by record.assignmentGroup,record.priority ]]> `

Last 24 hours


WorkGroup

<![CDATA[where record.priority="1" ]]>
bar
gaps
default
false
right

 </chart>

<![CDATA[where record.priority="2" ]]>
bar
gaps
default
false
right

 </chart>
 <chart>
   <title>Count by priority -3</title>
   <searchPostProcess> <![CDATA[where record.priority="3"  ]]> </searchPostProcess> 
   <option name="charting.chart">column</option> 
   <option name="charting.chart.nullValueMode">gaps</option>
   <option name="charting.chart.stackMode">stacked</option> 
   <option name="charting.layout.splitSeries">false</option> 
   <option name="charting.legend.placement">right</option> 
   <option name="count">10</option>
   <option name="displayRowNumbers">true</option> 

 </chart> 

I don't know why but the data isn't getting populated in the charts. Can anyone please explain where I am doing a mistake. Any help would be great.

Thanks

[theouhuios]

Made changes and pasted the code again. Now in the postprocess it only has the where field. Am I missing something here?

[dart]

change the post processes to just the where clause and remove the field, eg. |where record.priority=3 | fields - record.priority.
You don't have _time anymore, so you can't bucket by it. You'd need to bucket by time in the original search template.

[theouhuios]

Thanks for that. But it still doesn't populate the charts below. Am I doing anything wrong in the searchTemplate ?

[theouhuios]

Thanks for that. But it still doesn't populate the charts below. Am I doing anything wrong in the searchTemplate ?

[dart]

The properties are searchPostProcess and searchTemplate not searchpostprocess or searchtemplate. Does that sort it out?

[theouhuios]

Any help please?