Hello,
I'm facing a strong issue with using a mstats command, working in a post-processing components on a dynamic webpage.
Here is the thing, my basesearch is :
var basesearch = new SearchManager({
"id": "basesearch",
"earliest_time": "$field9.earliest$",
"latest_time": "$field9.latest$",
"search": "|mstats",
"status_buckets": 0,
"sample_ratio": 1,
"cancelOnUnload": true,
"app": utils.getCurrentApp(),
"auto_cancel": 90,
cache: true,
"runWhenTimeIsUndefined": false
}, {tokens: true, tokenNamespace: "submitted"});
The search is :
var search_metrics=" avg(_value) where metric_name=\"*."+rows[i][4].toString()+"\" span=5s by metric_name";
new PostProcessManager({
"search": mvc.tokenSafe(search_metrics),
"managerid": "basesearch",
"id": searchID
}, {tokens: true, tokenNamespace: "submitted"});
As you can see, I there is a dynamic variable rows[i][4] in the search, preventing me to put it in the basesearch. BUT, as Splunk adds automatically a pipe between the basesearch and the subsearch, it can't work. Do you have an idea on how to deal with it ? The basesearch can't be empty
Thanks in advance