Splunk Search

splunk trending...

DTERM
Contributor

I'm trying to integrate information from this link http://splunk-base.splunk.com/answers/13482/plotting-trendlines-into-the-future into my search and am having a few issues.

I've created the lineartrend(2) and extrendtrend(2) as suggested by the link above. Now I'd like to pass those macros into a search utilizing an index, not syslog. That being said, when I run the following query

index=myapp |timechart count
| lineartrend(_time, count)
| extendtrend(newY, 7)
| eval low_threshold=5000
| eval high_threshold=50000
| timechart values(count) as events values(newY) as linear_trend values(low_threshold) as low_threshold values(high_threshold) as high_threshold

The error I get is a the following:

Search operation 'args; is unknown. You might not have permission to run this operation.

Now I'm running this as admin, so the latter part of the error is not accurate at all.

Why is the search complaining about 'args'? What am I missing?

TIA

Tags (1)
0 Karma
1 Solution

Paolo_Prigione
Builder

You have to invoke macros enclosed in backtics `.

index=myapp |timechart count 
  | `lineartrend(_time, count)`
  | `extendtrend(newY, 7)`
  | eval low_threshold=5000 
  | eval high_threshold=50000 
  | timechart values(count) as events values(newY) as linear_trend values(low_threshold) as     low_threshold values(high_threshold) as high_threshold

View solution in original post

0 Karma

Paolo_Prigione
Builder

You have to invoke macros enclosed in backtics `.

index=myapp |timechart count 
  | `lineartrend(_time, count)`
  | `extendtrend(newY, 7)`
  | eval low_threshold=5000 
  | eval high_threshold=50000 
  | timechart values(count) as events values(newY) as linear_trend values(low_threshold) as     low_threshold values(high_threshold) as high_threshold
0 Karma

DTERM
Contributor

The macros were copied and pasted directly from the link. Unless there is a typo in the posted macros, I don't think that is true.

What is a good test to see if the macros work stand alone? My test is just piping the entire index into the macro. Is there a better test?

0 Karma

lguinn2
Legend

My guess is that you have a typo in your macros.conf file, but there is no way to tell from here...

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...