Splunk Search

Postprocessing search with tokens in base search not returning results

Contributor

I'm trying to build a form with a base search and post processing search as below. The panel gets loaded from a drilldown with ...<panelname>?form.host=<hostname>

I don't get any results for the field PercentSystemTime. The table just shows the timestamps and st as "Is Null", but if I click onto 'Open in Search' (the lens in the lower left corner), then I get the values displayed. And what is really is puzzling me, it works if I modify the search in the panel so it does not use the base search.

<form>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" token="time_picker">
      <label>Time Range</label>
      <default>
        <earliestTime>-30m</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
    <input token="host" >
    </input>
  </fieldset>
  <row>
    <panel>
      <search id="HostBaseSearch">
        <query>index=os host=$host$ </query>
        <earliest>$time_picker.earliest$</earliest>
        <latest>$time_picker.latest$</latest>
      </search>
      <table>
        <search base="HostBaseSearch">
          <query>
            search sourcetype="cpu"              
              | eval st=if(ISNULL(PercentSystemTime),"Is Null",PercentSystemTime)
              | table _time st 
          </query>
        </search>
      </table>
    </panel>
  </row>
</form>

Modified Search in the panel which works:

<search>
  <query>
    index=os host=$host$  sourcetype="cpu"              
      | eval st=if(ISNULL(PercentSystemTime),"Is Null",PercentSystemTime)
      | table _time st 
  </query>
</search>
0 Karma
1 Solution

Champion

To use post process searches you must use a transforming command before you reference searches will work. A transforming command is fields, tables, stats, etc. There is also limit of events which can be passed from the base to the reference search.

index=os host=$host$ sourcetype="cpu" | fields _time host PercentSystemTime

OR 

index=os host=$host$ sourcetype="cpu" | table _time host PercentSystemTime

View solution in original post

Champion

To use post process searches you must use a transforming command before you reference searches will work. A transforming command is fields, tables, stats, etc. There is also limit of events which can be passed from the base to the reference search.

index=os host=$host$ sourcetype="cpu" | fields _time host PercentSystemTime

OR 

index=os host=$host$ sourcetype="cpu" | table _time host PercentSystemTime

View solution in original post

Contributor

basic error, and I did not notice it as I had transforming commands in the other dashboards I build by accident 😉
Thanks you for your reply

0 Karma