thanks for your advice.
the issue is resolved, its some compatibility issues with the user.
Hi.. let me know the capability required for the user to use gauge command
What happened on 31st July 2014?
Any upgrades?
The problem doesn't jump out at me directly, but perhaps the usage of % in an eval field is gumming up the works. Can you try changing the variable name from success% to success? I am wondering if splunk is considering that a modulo operator isntead of a variable.
these was working fine till 31st July 2014. from 1st Aug onwards we had problem with gauge class.
saying " unknown search command 'gauge' "
the query is
index="wcp_idx" sourcetype="jtc_log" Operation="{String:TopUpWithCard}"|stats count(eval(EventType="{String:Request}")) AS total, count(eval(EventType="{String:Reply}")) AS complete | eval success%=round(((complete/total)*100),1)|fillnull success% value=0 | gauge success%
Please post the actual search string you are having difficulty with, and the specific error message. Your query is too vague.