I have a splunk 4.2.2 installation where I am doing the following search and plotting the results . Search works some times and other times I get the following error .
Query:
index="emc_stats" | timechart span=5m avg(read_IO),avg(WIO),avg(RKB),avg(WKB),avg(RH_pct),avg(WH_pct),avg(RS_pct),avg(WS_pct),avg(WPT) by sid_dg
Error
PARSER: Applying intentions failed plot: Cannot split when specifying more than one field.
Any help is appriciated!
I got this to work the way I wanted by renaming the sid_dg field and then doing timechart..The working query is
index="emc_stats" | eval groupby=sid_dg|timechart span=5m avg(read_IO),avg(WIO),avg(RKB),avg(WKB),avg(RH_pct),avg(WH_pct),avg(RS_pct),avg(WS_pct),avg(WPT) by groupby
I got this to work the way I wanted by renaming the sid_dg field and then doing timechart..The working query is
index="emc_stats" | eval groupby=sid_dg|timechart span=5m avg(read_IO),avg(WIO),avg(RKB),avg(WKB),avg(RH_pct),avg(WH_pct),avg(RS_pct),avg(WS_pct),avg(WPT) by groupby