Dashboards & Visualizations

JSChart with Post Process

matthewcanty
Communicator

Could someone give a simple example of how to use Post Process with JSChart?

I want a base search of index=daldev

Then two charts, the first:
timechart per_second(A) by Action

second:
timechart per_second(B) by Action

Tags (1)
1 Solution

sideview
SplunkTrust
SplunkTrust

Well at the simplest level, you can use those exact searches, but you have to sneak in a

| fields A B Action _time 

onto the end in order for the base search to run the field extractions for A and B. Unless it sees evidence that a given field is necessary for the base search, Splunk wont extract it and therefore it wont exist come post-process time.

However it's not best-practice to use postprocess in situations where the base search is a simple search for events. Instead you use stats and as necessary the bin command to make a base search that is itself a transforming search. This results in better performance and avoids some scaling problems.

Let's say the final granularity of your timecharts is such that one bucket equals one hour.

base search:

index=daldev | bin _time span=1h | stats sum(A) as A sum(B) as B count by _time Action

postprocess 1:

timechart per_second(A) by Action

postprocess 2:

timechart per_second(B) by Action

View solution in original post

sideview
SplunkTrust
SplunkTrust

Well at the simplest level, you can use those exact searches, but you have to sneak in a

| fields A B Action _time 

onto the end in order for the base search to run the field extractions for A and B. Unless it sees evidence that a given field is necessary for the base search, Splunk wont extract it and therefore it wont exist come post-process time.

However it's not best-practice to use postprocess in situations where the base search is a simple search for events. Instead you use stats and as necessary the bin command to make a base search that is itself a transforming search. This results in better performance and avoids some scaling problems.

Let's say the final granularity of your timecharts is such that one bucket equals one hour.

base search:

index=daldev | bin _time span=1h | stats sum(A) as A sum(B) as B count by _time Action

postprocess 1:

timechart per_second(A) by Action

postprocess 2:

timechart per_second(B) by Action
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...