Splunk Search

Why are data model metrics not showing up with this search?

locose
Path Finder

The following searches work :

| tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap_free) AS swap_free FROM datamodel=COY_Performance  WHERE nodename="All_Performance.Memory"  AND All_Performance.dest="hostname-11"

| tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap) AS swap FROM datamodel=COY_Performance  WHERE nodename="All_Performance.Memory"  AND All_Performance.dest="hostname-11"

This doesn’t work

| tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap_used) AS swap_used  FROM datamodel=COY_Performance  WHERE nodename="All_Performance.Memory"  AND All_Performance.dest="hostname-11"

But via the pivot on the datamodel, I do see metrics from "All_Performance.Memory.swap_used".

Any reason why my search returns nothing for

| tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap_used) AS swap_used  FROM datamodel=COY_Performance  WHERE nodename="All_Performance.Memory"  AND All_Performance.dest="hostname-11"
0 Karma

ehudb
Contributor

Try using values() instead of avg(), to check what values are extracting.
Maybe that field configuration in the datamodel was supposed to be a number but was configured as a string?

0 Karma

locose
Path Finder

Values() doesn't work and the field is configured as number

0 Karma

ehudb
Contributor

What do you mean values doesn't work?
What result you get for:

| tstats xxxx_summaries_only values(All_Performance.Memory.swap_used) AS swap_used FROM datamodel=COY_Performance WHERE nodename="All_Performance.Memory" AND All_Performance.dest="hostname-11"

0 Karma

locose
Path Finder

correct.
tstats xxxx_summaries_only values(All_Performance.Memory.swap_used) AS swap_used FROM datamodel=COY_Performance WHERE nodename="All_Performance.Memory" AND All_Performance.dest="hostname-11"

didn't work

0 Karma

ehudb
Contributor

didn't work, but what do you get as a result?

0 Karma

locose
Path Finder

"no results found"

0 Karma

ehudb
Contributor

Try to view the table in the pivot, and click "open in search"
Then inspect the search details and look in search.log
You will find the |tstats that was running in the background

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...