Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

why does this form search work

$
0
0

Can anybody enlighten me on why the form below (shortened) works when it's designed exactly this way, but not in any other? (using splunk 4.3.6)

Specifically, in the <searchPostProcess> I wanted to use something like

stats sum(r) as "requests" by $resolution$
or even move the whole second stats part into the <serachPostProcess> section,
or use fields $resolution$ requests instead of spelling out all possibilities for $resolution$,
but $resolution$ is not picked up in there.

The same when trying with multiple searches, placing <searchtemplyte> into each visualization will not pick up $resolution$ either.

Bug in my thinking? Bug in the software? No bug at all? (Either way bugging me...)

<form>
  <label>Longtime Statistics</label>

<searchTemplate>
    index=xxx_xxxxxxx_app_summary search_name="summaryfill_longtime_statistics"
      | eval day=strftime(_time, "%Y-%m-%d")
      | eval week=strftime(_time, "%Y-wk%V")
      | eval month=strftime(_time, "%Y-%m")
        | stats
                count AS r
                dc(sessionid) as u
                sum(is_longrunning) as d
          by day, week, month
        | stats
                avg(r) AS avg_r
                avg(u) AS avg_u
                avg(d) AS avg_d
                sum(r) AS requests
                sum(u) as "unique sessionid's"
                sum(d) as "duration > 10s"
          by $resolution$
          | eval "requests avg/day"=round(avg_r,0)
          | eval "unique sessionid's avg/day"=round(avg_u,0)
          | eval "duration > 10s avg/day"=round(avg_d,0)
    | rename search_documentation AS "

01)    select index and search_name (from summary index filling search)
    02-04) calculate a day, week and month fields used to segment by later on
    05-09) create a statistics table with
           - total count of requests (r)
           - number of unique sessionid's (u)
           - total of requests with the longrunning flag set (d)
           by day, week and month identifiers (for further segmentation
           further down)
    10-17) take the statistics table just produced and expand it with averages
           so it contains the following fields, by resolution
           (resolution is day/week/month as selected by radiobutton)
           - average of requests per day (avg_r)
           - average of unique sessionid's per day (avg_u)
           - average of longrunning requests per day (avg_d)
           - total number of requests (requests)
           - number of unique sessionid's (unique sessionid's)
           - total of requests with the longrunning flag set (duration > 10s)
    18-20) the averages are floating point, but we want integers, so they
           are rounded
    "
  </searchTemplate>

<fieldset autoRun="true" submitButton="false">

<input type="time" searchWhenChanged="true">
      <label>Timerange:</label>
      <default>Year to date</default>
    </input>

<input type="radio" token="resolution" searchWhenChanged="true">
      <label>Resolution:</label>
      <default>monthly</default>
      <choice value="day">daily</choice>
      <choice value="week">weekly</choice>
      <choice value="month">monthly</choice>
    </input>

</fieldset>

<row>
    <chart>
      <searchPostProcess>fields month week day requests</searchPostProcess>
      <!-- chart options removed -->
    </chart>
  </row>

<!-- remaining visualizations removed -->

</form>

Viewing all articles
Browse latest Browse all 13053

Trending Articles