why splunk doesn't resolve stats count on postprocess ?

[sfatnass]

when i try to run a stats count using postprocess splunk doesn't resolve the query search and i don't know why ?

this is my dashboard :

<form>
  <label>Post Process Search</label>
  <description>Each panel post processes the base search through a separate search pipeline.</description>
  <search id="internal_data">
      <query>index=_internal </query>
  </search>
  <fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true">
      <default>
        <earliest>0</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
     <table>
      <title>Top Sourcetypes</title>
      <search base="internal_data">
          <query>stats count(uri_path)</query>
      </search>

    </table>
    <chart>
      <title>Events over Time</title>
      <search base="internal_data">
          <query>timechart count</query>
      </search>
      <option name="charting.chart">column</option>
    </chart>

  </row>
</form>

[TStrauch · Accepted solution]

Hi,

its a little tricky. Splunk runs all Dashboard searches in fast mode. So for your search index=_internal no fields are extracted during search time. This means you cannot do a stats command on "uri_path" because splunk just dont know the field in your postprocess search. just do

"index=_internal | fields *" for your basesearch and it will work.

https://answers.splunk.com/answers/152287/why-search-with-postprocessing-returns-no-results-in-dashb...

regards

[sfatnass]

thx ^^ it worl perfectly

[bmacias84]

Basically you must apply a transforming command in your base search fields, stats, etc. Keep in mind that their is 100,000 event limit when using post process searches.

[sfatnass]

but it's possible to extend this limit?

[bmacias84]

Limits are controlled through limits.conf. I've never been able to ID a corresponding setting.