JSChart with Post Process

[matthewcanty]

Could someone give a simple example of how to use Post Process with JSChart?

I want a base search of index=daldev

Then two charts, the first:
timechart per_second(A) by Action

second:
timechart per_second(B) by Action

[sideview · Accepted solution]

Well at the simplest level, you can use those exact searches, but you have to sneak in a

| fields A B Action _time 

onto the end in order for the base search to run the field extractions for A and B. Unless it sees evidence that a given field is necessary for the base search, Splunk wont extract it and therefore it wont exist come post-process time.

However it's not best-practice to use postprocess in situations where the base search is a simple search for events. Instead you use stats and as necessary the bin command to make a base search that is itself a transforming search. This results in better performance and avoids some scaling problems.

Let's say the final granularity of your timecharts is such that one bucket equals one hour.

base search:

index=daldev | bin _time span=1h | stats sum(A) as A sum(B) as B count by _time Action

postprocess 1:

timechart per_second(A) by Action

postprocess 2:

timechart per_second(B) by Action