Splunk Search

How do I do Field (column) selection for post process search in a dashboard panel?

New Member

In a dashboard I'm trying to drive several charts off a single query and use post process search to select the fields that I want.
The timechart has a "by" clause and I wanted to select fields (columns in this case) for each chart based on the prefix which is the by field followed by a "-".
Assuming the by field is an "a" or a "b" I end up with fields like - _time, a-avgcpu,a-maxcpu,b-avgcpu,b-maxcpu
I wanted to chart them separately
So I tried <query> | fields _time,a-* and <query> | fields _time,b-*
For all the charts they just come up empty. Tried the equivalent search outside the dashboard app and it only displays the _time field.

Does using the by clause change something fundamental that I've missed to do with result names...is there another way to do this? ( I see from another question that it appears to be possible if there is no by clause, although they are also not using a wild card field selection in that question either)

0 Karma


You'll want your base search to end with | timechart something by something, and each postprocess search to be | fields _* a-*. Make sure your field names after the timechart match exactly to the fields.
There's a little bit of magic hidden in fields like _span to drive timechart-specific rendering, such as the fancy date axis.

For a nicer way, consider this:

base search:
... | bin _time | stats avg(something) as avgsomething by _time splitfield
post process 1:
| search splitfield=a | fields - splitfield | timechart values(*) as *
post process 2:
| search splitfield=b | fields - splitfield | timechart values(*) as *

In general, you'll want to only use timechart at the end and stick to bin|stats for intermediate steps. That way you don't end up with very wide tables and dynamic/unknown field names caused by the split-by field.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!