Splunk Search

Why are data model metrics not showing up with this search?

locose
Path Finder

The following searches work :

| tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap_free) AS swap_free FROM datamodel=COY_Performance  WHERE nodename="All_Performance.Memory"  AND All_Performance.dest="hostname-11"

| tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap) AS swap FROM datamodel=COY_Performance  WHERE nodename="All_Performance.Memory"  AND All_Performance.dest="hostname-11"

This doesn’t work

| tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap_used) AS swap_used  FROM datamodel=COY_Performance  WHERE nodename="All_Performance.Memory"  AND All_Performance.dest="hostname-11"

But via the pivot on the datamodel, I do see metrics from "All_Performance.Memory.swap_used".

Any reason why my search returns nothing for

| tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap_used) AS swap_used  FROM datamodel=COY_Performance  WHERE nodename="All_Performance.Memory"  AND All_Performance.dest="hostname-11"
0 Karma

ehudb
Contributor

Try using values() instead of avg(), to check what values are extracting.
Maybe that field configuration in the datamodel was supposed to be a number but was configured as a string?

0 Karma

locose
Path Finder

Values() doesn't work and the field is configured as number

0 Karma

ehudb
Contributor

What do you mean values doesn't work?
What result you get for:

| tstats xxxx_summaries_only values(All_Performance.Memory.swap_used) AS swap_used FROM datamodel=COY_Performance WHERE nodename="All_Performance.Memory" AND All_Performance.dest="hostname-11"

0 Karma

locose
Path Finder

correct.
tstats xxxx_summaries_only values(All_Performance.Memory.swap_used) AS swap_used FROM datamodel=COY_Performance WHERE nodename="All_Performance.Memory" AND All_Performance.dest="hostname-11"

didn't work

0 Karma

ehudb
Contributor

didn't work, but what do you get as a result?

0 Karma

locose
Path Finder

"no results found"

0 Karma

ehudb
Contributor

Try to view the table in the pivot, and click "open in search"
Then inspect the search details and look in search.log
You will find the |tstats that was running in the background

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...