Splunk Search

Help on Errror stats - The argument '>' is invalid

apro
Path Finder

I am scheduling this search(Daily Indexed Volume):

index=_internal source=*metrics.log splunk_server="*" | eval MB=kb/1024 | search group="per_host_thruput" | chart sum(MB) by series | rename series AS "Host(s)" | sort sum(MB) | addcoltotals col=t | fillnull value="[ Total Indexed Volume ] last 24 hours" Host(s)

but it seems to be generating the following errors:

in splunkd.log: 06-25-2010 10:04:27.285 ERROR stats - The argument '>' is invalid.

in scheduler.log: 06-25-2010 10:04:27.285 ERROR SavedSplunker - savedsearch_id="myuserid;search;Daily Indexed Volume", Error in 'stats': The argument '>' is invalid.

Any idea??

Tags (3)
0 Karma
1 Solution

Lowell
Super Champion

That is rather weird, since you don't seem to be using the stats search command at all (although "stats" could be "chart" in your case, I'm not sure how that works exactly.)

The approach that Simeon suggests is a good one.

I would suggest that you make the following change to your search (it should be much more efficient):

index=_internal source=*metrics.log splunk_server="*" | eval MB=kb/1024 | search group="per_host_thruput" | ...

Would be much faster if written as:

index=_internal source=*metrics.log splunk_server="*" group="per_host_thruput" | eval MB=kb/1024 | ...

The reason for this is there are tons of metrics events, and only some of them contain the term per_host_thruput, so by moving that to your first search you let splunk search for that within the index, instead of searching for it on a secondary pass over the events. (Of course, that wouldn't cause the error you are seeing, but it should make your search fastser and more efficient)

View solution in original post

0 Karma

Lowell
Super Champion

That is rather weird, since you don't seem to be using the stats search command at all (although "stats" could be "chart" in your case, I'm not sure how that works exactly.)

The approach that Simeon suggests is a good one.

I would suggest that you make the following change to your search (it should be much more efficient):

index=_internal source=*metrics.log splunk_server="*" | eval MB=kb/1024 | search group="per_host_thruput" | ...

Would be much faster if written as:

index=_internal source=*metrics.log splunk_server="*" group="per_host_thruput" | eval MB=kb/1024 | ...

The reason for this is there are tons of metrics events, and only some of them contain the term per_host_thruput, so by moving that to your first search you let splunk search for that within the index, instead of searching for it on a secondary pass over the events. (Of course, that wouldn't cause the error you are seeing, but it should make your search fastser and more efficient)

0 Karma

Simeon
Splunk Employee
Splunk Employee

I would begin by removing each additional pipe function to see what is causing the error. Since the error is in "stats", I would begin by removing the statistical functions.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...