How to convert base search query that uses stats into a timechart?

[lsy9891]

Hi, I want to display this query in my dashboard in two different charts.

So this is my base search query:
search base="OrderSearch"

host=NETWEBA* sourcetype=iis NOT("ErrorGuid") (sc_status="2**" OR sc_status="3**") "GET" | rex field=cs_referer "https:\/\/[a-zA-Z]+\.[a-zA-Z]+\.([a-zA-Z]+|[a-zA-Z]+.[a-zA-Z]+)\/order20\/order\/confirmation-v2\/(?<orderID>[0-9]+)(.*)"  | dedup orderID |stats count by cs_host

Then I want to display this in a different timechart:

search id="OrderSearch"

timechart span=1h count(orderID) as Number_of_Orders

I tried changing it to eventstats but it didn't work?

[richgalloway]

You have your search tags reversed. The base search should useid="OrderSearch" and the post-processing search should use base="OrderSearch".

That said, the timesearch fails because it needs _time and orderID fields, neither of which come out of the base search because stats filters fields to those explicitly mentioned. eventstats should fix that once the fix above is implemented.

[lsy9891]

Hi, I've swapped the base search and post-processing search and changed it to eventstats but then the base search will not display a chart since we can pick the visualization for stats but not eventstats?

Basically, I need the base query to display a pie chart from stats count by cs_host and the post search query to display a timechart. Timechart span=1h count(orderID) as Number_of_Orders

[richgalloway]

Base searches should not create visualizations. Do the visualization in post-processing.