Splunk Search

How to display maximum power usage in last 24 hours in a table

geetanjali
Path Finder

Hi,
i have my results :

Host | max(usage)

ABC | 100

xyz | 200

I want to add new column in table with max(usage) in last 24 hours by host.

| Max usage (last 24 hours)

| 90

| 200

Tags (1)
0 Karma

MarioM
Motivator

did you try join?

| join [ search <yoursearch> earliest=-24h | stats max(usage) by host ] 
0 Karma

geetanjali
Path Finder

My initial search is for max consumption for entire log. But in subsearch, want maximum comsumption in last 24 hours.

Host | max(usage) | Max usage (last 24 hours)

ABC | 100 | 90

xyz | 200 | 90

0 Karma

MarioM
Motivator

your initial search is same as you subsearch then subsearch is not needed,this should be enough:

index="power" sourcetype="power_usage" earliest=-24h | chart max(Power_consumption) over host

0 Karma

geetanjali
Path Finder

Hi,
I am writing following query :

index="power" sourcetype="power_usage" | join [ search index="power" sourcetype="power_usage" earliest=-24h | table Power_consumption by host ]| chart max(Power_consumption) over host

Its again giving following error:-

[subsearch]: Your timerange was substituted based on your search string

0 Karma

MarioM
Motivator

what is timerange of your initial search? just add the corresponding earliest= to this initial search too.

0 Karma

geetanjali
Path Finder

Hi,
Thanks for the solution. I have implemented this in my query. its giving following error :

[subsearch]: Your timerange was substituted based on your search string

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...