Reporting

Why is my post process real-time base saved search failing to graph values if I change "where timing < 10" to "fields timing" or "timechart avg(timing)"?

tborup
Engager

I have a dashboard referring a saved search. The search is a real-time search returning the values timing and count by _time. The dashboard works fine until I change "where timing < 10" to "fields timing" or "timechart avg(timing)". After this change, no values are shown in the graph. Can this be explained in any way?

The goal is to use one real-time search on both a graph with two values (timing and count) and a gauge only showing the value of count.

<dashboard>
  <search id="BaseSearch" ref="Request pr.min RT"></search>
  <row>
    <panel>
      <chart>
        <search base="BaseSearch">
          <query>where timing < 10</query>
        </search>
.....

Splunk version: 6.2.3

0 Karma
1 Solution

tborup
Engager

If I change the query part to this

    <search base="BaseSearch">
      <query>fields _time count timing</query>
    </search>

the value timing disappears. This is unexpected, but it gives me the result I want and I am able to show the count value in a gauge.

In case the basesearch is important in giving the answer to this unexpected behavior, I'll provide it here.

`FMK_servers_auditLog` | fields _time processingTime | bin _time span=2s as sek2 | eval sek=strftime(sek2,"%H:%M:%S") | stats count avg(processingTime) as timing by sek | eval count = count*0.5 | eval timing = timing/10

View solution in original post

tborup
Engager

If I change the query part to this

    <search base="BaseSearch">
      <query>fields _time count timing</query>
    </search>

the value timing disappears. This is unexpected, but it gives me the result I want and I am able to show the count value in a gauge.

In case the basesearch is important in giving the answer to this unexpected behavior, I'll provide it here.

`FMK_servers_auditLog` | fields _time processingTime | bin _time span=2s as sek2 | eval sek=strftime(sek2,"%H:%M:%S") | stats count avg(processingTime) as timing by sek | eval count = count*0.5 | eval timing = timing/10
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...