It is great the Splunk 6.2 allows multiple base searches. However I was wondering if postprocess chaining is possible.. That is a post process search is a base search for another post process search. The following is a cooked up dashboard XML that will illustrate what i am trying. I am not getting intended results. Not sure if it is a supported feature
<dashboard>
<label>TempPostProcessChaining</label>
<search id="baseSearch">
<query>|stats count as dummy</query>
</search>
<row>
<panel>
<title>First Post Process Result</title>
<table>
<search base="baseSearch" id="firstPostProcess">
<query>eval a=dummy+1 | fields *</query>
</search>
</table>
</panel>
</row>
<row>
<panel>
<title>Second Post Process Result</title>
<table>
<search base="firstPostProcess">
<query>eval b=a+1 | fields *</query>
</search>
</table>
</panel>
</row>
</dashboard>
I'd say no.
The observed behaviour is similar to the old AdvancedXML PostProcess Module - while you could have multiple post processes underneath each other, one would override the other so you would always have base search | post process
, never base search | post process 1 | post process 2
. You can see this more clearly if you add | eval c = dummy + 10
to your second post process - it is applied, but the first post process is skipped.
The docs aren't terribly clear on this, but they do say "Post-process searches: A search that further modifies results from a base search." Taking that literally, a post process will always modify the base search... exactly what we're observing here.
http://docs.splunk.com/Documentation/Splunk/6.2.3/Viz/PanelreferenceforSimplifiedXML