Splunk Search

splunk trending...

DTERM
Contributor

I'm trying to integrate information from this link http://splunk-base.splunk.com/answers/13482/plotting-trendlines-into-the-future into my search and am having a few issues.

I've created the lineartrend(2) and extrendtrend(2) as suggested by the link above. Now I'd like to pass those macros into a search utilizing an index, not syslog. That being said, when I run the following query

index=myapp |timechart count
| lineartrend(_time, count)
| extendtrend(newY, 7)
| eval low_threshold=5000
| eval high_threshold=50000
| timechart values(count) as events values(newY) as linear_trend values(low_threshold) as low_threshold values(high_threshold) as high_threshold

The error I get is a the following:

Search operation 'args; is unknown. You might not have permission to run this operation.

Now I'm running this as admin, so the latter part of the error is not accurate at all.

Why is the search complaining about 'args'? What am I missing?

TIA

Tags (1)
0 Karma
1 Solution

Paolo_Prigione
Builder

You have to invoke macros enclosed in backtics `.

index=myapp |timechart count 
  | `lineartrend(_time, count)`
  | `extendtrend(newY, 7)`
  | eval low_threshold=5000 
  | eval high_threshold=50000 
  | timechart values(count) as events values(newY) as linear_trend values(low_threshold) as     low_threshold values(high_threshold) as high_threshold

View solution in original post

0 Karma

Paolo_Prigione
Builder

You have to invoke macros enclosed in backtics `.

index=myapp |timechart count 
  | `lineartrend(_time, count)`
  | `extendtrend(newY, 7)`
  | eval low_threshold=5000 
  | eval high_threshold=50000 
  | timechart values(count) as events values(newY) as linear_trend values(low_threshold) as     low_threshold values(high_threshold) as high_threshold
0 Karma

DTERM
Contributor

The macros were copied and pasted directly from the link. Unless there is a typo in the posted macros, I don't think that is true.

What is a good test to see if the macros work stand alone? My test is just piping the entire index into the macro. Is there a better test?

0 Karma

lguinn2
Legend

My guess is that you have a typo in your macros.conf file, but there is no way to tell from here...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...