Why is my post process real-time base saved search failing to graph values if I change "where timing < 10" to "fields timing" or "timechart avg(timing)"?

[tborup]

I have a dashboard referring a saved search. The search is a real-time search returning the values timing and count by _time. The dashboard works fine until I change "where timing < 10" to "fields timing" or "timechart avg(timing)". After this change, no values are shown in the graph. Can this be explained in any way?

The goal is to use one real-time search on both a graph with two values (timing and count) and a gauge only showing the value of count.

<dashboard>
  <search id="BaseSearch" ref="Request pr.min RT"></search>
  <row>
    <panel>
      <chart>
        <search base="BaseSearch">
          <query>where timing < 10</query>
        </search>
.....

Splunk version: 6.2.3

[tborup · Accepted solution]

If I change the query part to this

    <search base="BaseSearch">
      <query>fields _time count timing</query>
    </search>

the value timing disappears. This is unexpected, but it gives me the result I want and I am able to show the count value in a gauge.

In case the basesearch is important in giving the answer to this unexpected behavior, I'll provide it here.

`FMK_servers_auditLog` | fields _time processingTime | bin _time span=2s as sek2 | eval sek=strftime(sek2,"%H:%M:%S") | stats count avg(processingTime) as timing by sek | eval count = count*0.5 | eval timing = timing/10