Why are 2 of my 3 HiddenPostProcess searches returning zero results?

[luxiaobin]

Hi, I'm using HiddenPostProcess. I made three HiddenPostProcess searches. The first returns the right number, but the others return 0. Can someone tell me what's wrong with my search? thx!

    <param name="search">index=idx_source=*xx*|where strftime(strptime(REGIST_TIME,"%s"),"%Y") = strftime(now(),"%Y")|where strftime(strptime(REGIST_TIME,"%s"),"%m") = strftime(now(),"%m")</param>
    <module name="HiddenPostProcess">
        <param name="search">|stats count</param>
        <module name="SingleValue">
            <param name="beforeLabel">共</param>
            <param name="format">number</param>
            <param name="afterLabel">人</param>
        </module>
    </module>
    <module name="HiddenPostProcess">
        <param name="search">|where GENDER=1|stats count</param>
        <module name="SingleValue">
            <param name="beforeLabel">女</param>
            <param name="format">number</param>
            <param name="afterLabel">人</param>
        </module>
    </module>
    <module name="HiddenPostProcess">
        <param name="search">|where GENDER=0|stats count</param>
        <module name="SingleValue">
            <param name="beforeLabel">男</param>
            <param name="format">number</param>
            <param name="afterLabel">人</param>
        </module>
    </module>
</module>

[luxiaobin · Accepted solution]

I find the solution from here http://answers.splunk.com/answers/36752/hiddenpostprocess.html

[DavidHourani]

Are you sure you have the field GENDER ? if so, why not do a |stats count by GENDER just to be sure that you actually have something...Do that in the search that is working, then add |search GENDER=0to see what you get 🙂

[ramdaspr]

I havent tried HiddenPostProcess in a module yet, so this is just a guess. Try using search instead of where

 <module name="HiddenPostProcess">
         <param name="search">| search GENDER=1|stats count</param>

[luxiaobin]

it doesn`t work . anyway thx!