Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

PostProcess search filters seem to be missing results (sideview)

$
0
0

hi,

I'm building a dashboard using the awesome Sideview Utils, but in my view, I seem to be missing data. My view has the following structure:

<search>
    <postprocess>
    <postprocess>
    <postprocess>
    <postprocess>

each postprocess has a pager->table to render results. the base search returns results from stats:

... | stats latest(x) as x latest(y) as y latest(z) as z by UserID

And then each PostProcess looks at different fields, for e.g.

eval segment1=case(isnull(x),"None",x&gt;10,"Big",x=0,"None") | stats dc(UserID) as NumUsers by segment1 | addcoltotals labelfield=segment1 label=TOTAL

And then the 2nd PostProcess will segment based on "y". the above is a really simplified example of what the actual search is doing, but they all have a similar approach: segment according to a field, and then run through stats by the segmentation field. When I run the view, I get inconsistent numbers - all 4 postprocesses should come up with the same number of users in the total, but 1 & 2 return 3802 users (correct), while the 3rd and 4th postprocess returns "308". I've added "$search$" to a debug panel and run the 3rd of 4th postprocess appended to the actual search, and when I run as a standard search, I get the correct number of results - 3802.

Is there any reason or configuration options I should be looking out for that limits the results in downstream postprocess configurations?


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>