Splunk Search

Missing data after I increase the numeric data in my where clause

cquinney
Communicator

Greetings

I'm using the following query over 24hrs.

| initial search
| timechart useother=f span=1h avg(field1) by field2 where avg > 100
| fields - NULL

And I get results for that meet that criteria, but when I increase the numeric value from > 100 to > 400, I get zero results even though I should see at least one or two fields from "field2" populate. Any thoughts on what is causing my dilemma?

0 Karma
1 Solution

lakshman239
SplunkTrust
SplunkTrust

you could do something like this

initial search
| stats avg(field1) AS avg by _time, field2 | where avg > 100 | xyseries _time field2 sum

View solution in original post

0 Karma

lakshman239
SplunkTrust
SplunkTrust

you could do something like this

initial search
| stats avg(field1) AS avg by _time, field2 | where avg > 100 | xyseries _time field2 sum
0 Karma

cquinney
Communicator

That will actually work for what I'm trying to accomplish, thank you!

0 Karma

Vijeta
Influencer

Try-

 | timechart limit=0 span=1h avg(field1) AS avg by field2  | where avg > 200
0 Karma

cquinney
Communicator

Thank you for the suggestion but that doesn't seem to work either.

0 Karma

lakshman239
SplunkTrust
SplunkTrust

pls accept the answer to close tracking.

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Pls change your search as below and re-test

 initial search
| timechart useother=f span=1h avg(field1) AS avg by field2 where avg > 100
0 Karma

cquinney
Communicator

Thank you for the suggestion, but the data still disappears when I increase the numeric value to 200 even though there should be results.

0 Karma

lakshman239
SplunkTrust
SplunkTrust

do you see avg more than 200 when you run

  initial search
 | timechart useother=f span=1h avg(field1) AS avg by field2  | where avg > 100
0 Karma

cquinney
Communicator

No, nothing populates regardless of the numeric value when I pipe the where clause to its own line I'm afraid.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...