Hello
I am completely new to the post processing concept hence having few issues with coding it in xml
`<?xml version='1.0' encoding='utf-8'?>
I don't know why but the data isn't getting populated in the charts. Can anyone please explain where I am doing a mistake. Any help would be great.
Thanks
Made changes and pasted the code again. Now in the postprocess it only has the where field. Am I missing something here?
change the post processes to just the where clause and remove the field, eg. |where record.priority=3 | fields - record.priority
.
You don't have _time anymore, so you can't bucket by it. You'd need to bucket by time in the original search template.
Thanks for that. But it still doesn't populate the charts below. Am I doing anything wrong in the searchTemplate ?
Thanks for that. But it still doesn't populate the charts below. Am I doing anything wrong in the searchTemplate ?
The properties are searchPostProcess
and searchTemplate
not searchpostprocess
or searchtemplate
. Does that sort it out?
Any help please?