Dashboards & Visualizations

choosing previous month not working when trying to do a dynamic gauge

HattrickNZ
Motivator

I have the following search:

index=core source="*source1*"...  | 
stats  max(field1) as "fieldname1" | 
gauge max(field1) as "fieldname1" 
[search index=core source="*source2*"   | 
rex field=Licensefilename "(?P<subname>(?<=_).*?(?=\.)).*"  | 
stats  max(field2) as fieldname2 | 
eval first=0 | 
eval second=fieldname2 -50/100*fieldname2 | 
eval third=fieldname2 -20/100*fieldname2 | 
eval fourth=fieldname2  | 
eval range=first+" "+second+" "+third+" "+fourth | return $range]

and it gives this output (i use this for creating a dynamic gauge visualisation)

x   y1  y2  y3  y4
216810  0   150000  240000  300000 

this works well if i choose the date to be yesterday or the last 30days, but if I choose the date to be the previous month i get this

x
217891  

whcih indicates to me that my $range is not being returned when I choose previous month

Anyway I can NOT get this to work for the previous month, which is what I want as opposed to the last X days.

Any way I can get this to work for previous month?

Tags (4)
0 Karma
1 Solution

HiroshiSatoh
Champion

Whether the data will be the presence of the previous month of sub-search?

index=core source="source2"

View solution in original post

0 Karma

HiroshiSatoh
Champion

Whether the data will be the presence of the previous month of sub-search?

index=core source="source2"

0 Karma

HattrickNZ
Motivator

if i pick last 30 days it works for my 1st search source="source1" and 2nd subsearch source="source2" if i understand correctly.

then if i pick previous month I want that to work(or be applied) to my 1st search source="source1" and 2nd subsearch source="source2"

Maybe you are saying that I have to put earliest=?? and latest=?? inside my 2nd subserch source="source2"?
I could give this a try but how would i write earliest=?? and latest=?? to be the previouse month?
Is it earliest=-1m@m and latest=@m?

0 Karma

HattrickNZ
Motivator

tks, I got it to work I think it was more a user error!!! 😞

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...