Getting Data In

How to use mstats with post-processing

pokpok
New Member

Hello,

I'm facing a strong issue with using a mstats command, working in a post-processing components on a dynamic webpage.

Here is the thing, my basesearch is :

var basesearch = new SearchManager({
            "id": "basesearch",
            "earliest_time": "$field9.earliest$",
            "latest_time": "$field9.latest$",
            "search": "|mstats",
            "status_buckets": 0,
            "sample_ratio": 1,
            "cancelOnUnload": true,
            "app": utils.getCurrentApp(),
            "auto_cancel": 90,
            cache: true,
            "runWhenTimeIsUndefined": false
        }, {tokens: true, tokenNamespace: "submitted"});

The search is :

var search_metrics=" avg(_value) where metric_name=\"*."+rows[i][4].toString()+"\" span=5s by metric_name";
new PostProcessManager({
                                                        "search": mvc.tokenSafe(search_metrics),
                                                        "managerid": "basesearch",
                                                        "id": searchID
                                                }, {tokens: true, tokenNamespace: "submitted"});

As you can see, I there is a dynamic variable rows[i][4] in the search, preventing me to put it in the basesearch. BUT, as Splunk adds automatically a pipe between the basesearch and the subsearch, it can't work. Do you have an idea on how to deal with it ? The basesearch can't be empty

Thanks in advance

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...