Can anybody enlighten me on why the form below (shortened) works when it's designed exactly this way, but not in any other? (using splunk 4.3.6)
Specifically, in the <searchPostProcess>
I wanted to use something like
stats sum(r) as "requests" by $resolution$or even move the whole second
stats
part into the <serachPostProcess>
section,or use
fields $resolution$ requests
instead of spelling out all possibilities for $resolution$,but $resolution$ is not picked up in there.
The same when trying with multiple searches, placing <searchtemplyte> into each visualization will not pick up $resolution$ either.
Bug in my thinking? Bug in the software? No bug at all? (Either way bugging me...)
<form> <label>Longtime Statistics</label> <searchTemplate> index=xxx_xxxxxxx_app_summary search_name="summaryfill_longtime_statistics" | eval day=strftime(_time, "%Y-%m-%d") | eval week=strftime(_time, "%Y-wk%V") | eval month=strftime(_time, "%Y-%m") | stats count AS r dc(sessionid) as u sum(is_longrunning) as d by day, week, month | stats avg(r) AS avg_r avg(u) AS avg_u avg(d) AS avg_d sum(r) AS requests sum(u) as "unique sessionid's" sum(d) as "duration > 10s" by $resolution$ | eval "requests avg/day"=round(avg_r,0) | eval "unique sessionid's avg/day"=round(avg_u,0) | eval "duration > 10s avg/day"=round(avg_d,0) | rename search_documentation AS " 01) select index and search_name (from summary index filling search) 02-04) calculate a day, week and month fields used to segment by later on 05-09) create a statistics table with - total count of requests (r) - number of unique sessionid's (u) - total of requests with the longrunning flag set (d) by day, week and month identifiers (for further segmentation further down) 10-17) take the statistics table just produced and expand it with averages so it contains the following fields, by resolution (resolution is day/week/month as selected by radiobutton) - average of requests per day (avg_r) - average of unique sessionid's per day (avg_u) - average of longrunning requests per day (avg_d) - total number of requests (requests) - number of unique sessionid's (unique sessionid's) - total of requests with the longrunning flag set (duration > 10s) 18-20) the averages are floating point, but we want integers, so they are rounded " </searchTemplate> <fieldset autoRun="true" submitButton="false"> <input type="time" searchWhenChanged="true"> <label>Timerange:</label> <default>Year to date</default> </input> <input type="radio" token="resolution" searchWhenChanged="true"> <label>Resolution:</label> <default>monthly</default> <choice value="day">daily</choice> <choice value="week">weekly</choice> <choice value="month">monthly</choice> </input> </fieldset> <row> <chart> <searchPostProcess>fields month week day requests</searchPostProcess> <!-- chart options removed --> </chart> </row> <!-- remaining visualizations removed --> </form>