Splunk Search

How to convert base search query that uses stats into a timechart?

Engager

Hi, I want to display this query in my dashboard in two different charts.

So this is my base search query:
search base="OrderSearch"

host=NETWEBA* sourcetype=iis NOT("ErrorGuid") (sc_status="2**" OR sc_status="3**") "GET" | rex field=cs_referer "https:\/\/[a-zA-Z]+\.[a-zA-Z]+\.([a-zA-Z]+|[a-zA-Z]+.[a-zA-Z]+)\/order20\/order\/confirmation-v2\/(?<orderID>[0-9]+)(.*)"  | dedup orderID |stats count by cs_host

Then I want to display this in a different timechart:

search id="OrderSearch"

timechart span=1h count(orderID) as Number_of_Orders

I tried changing it to eventstats but it didn't work?

0 Karma

SplunkTrust
SplunkTrust

You have your search tags reversed. The base search should useid="OrderSearch" and the post-processing search should use base="OrderSearch".

That said, the timesearch fails because it needs _time and orderID fields, neither of which come out of the base search because stats filters fields to those explicitly mentioned. eventstats should fix that once the fix above is implemented.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Engager

Hi, I've swapped the base search and post-processing search and changed it to eventstats but then the base search will not display a chart since we can pick the visualization for stats but not eventstats?

Basically, I need the base query to display a pie chart from stats count by cs_host and the post search query to display a timechart. Timechart span=1h count(orderID) as NumberofOrders

0 Karma

SplunkTrust
SplunkTrust

Base searches should not create visualizations. Do the visualization in post-processing.

---
If this reply helps you, an upvote would be appreciated.
0 Karma