Post processing using transforming command

[chetan1974]

While using post process, I have set base search as "index=_test source="/logs/trans.log" component=core|fields activity". In my post process query, using below search

timechart span=1h count(activity) as Activites

In my base query, there is no transforming command. When I try to use transforming command like timechart or stats, I do not get any results back.

How do I use transforming command to link base search and post process query?

[woodcock]

I am assuming that you are doing various kinds of timecharts for the post-process. If so check out my accepted answer here for the optimal approach:
https://answers.splunk.com/answers/541378/how-to-create-a-base-search-that-retains-multiple.html

[cmerriman]

In your base search use | fields _time activity
so that your post process can see _time for the timechart. You'll need to bring forward any interesting field in the fields command in your base search for any post process search.

[gcusello]

Hi chetan1974,
there is no problem to put transform command both in the base search and/or in one or more of the secondary searches.
The only attention point is to insert all the fields that you have in the secondary searches in the "field" command that is at the end of the base search.
Bye.
Giuseppe

[DalJeanis]

Did you try using the leading pipe? |stats etc.