Could someone give a simple example of how to use Post Process with JSChart?
I want a base search of index=daldev
Then two charts, the first:
timechart per_second(A) by Action
second:
timechart per_second(B) by Action
Well at the simplest level, you can use those exact searches, but you have to sneak in a
| fields A B Action _time
onto the end in order for the base search to run the field extractions for A and B. Unless it sees evidence that a given field is necessary for the base search, Splunk wont extract it and therefore it wont exist come post-process time.
However it's not best-practice to use postprocess in situations where the base search is a simple search for events. Instead you use stats and as necessary the bin command to make a base search that is itself a transforming search. This results in better performance and avoids some scaling problems.
Let's say the final granularity of your timecharts is such that one bucket equals one hour.
base search:
index=daldev | bin _time span=1h | stats sum(A) as A sum(B) as B count by _time Action
postprocess 1:
timechart per_second(A) by Action
postprocess 2:
timechart per_second(B) by Action
Well at the simplest level, you can use those exact searches, but you have to sneak in a
| fields A B Action _time
onto the end in order for the base search to run the field extractions for A and B. Unless it sees evidence that a given field is necessary for the base search, Splunk wont extract it and therefore it wont exist come post-process time.
However it's not best-practice to use postprocess in situations where the base search is a simple search for events. Instead you use stats and as necessary the bin command to make a base search that is itself a transforming search. This results in better performance and avoids some scaling problems.
Let's say the final granularity of your timecharts is such that one bucket equals one hour.
base search:
index=daldev | bin _time span=1h | stats sum(A) as A sum(B) as B count by _time Action
postprocess 1:
timechart per_second(A) by Action
postprocess 2:
timechart per_second(B) by Action