Knowledge Management

summary stats functions call back changed in 5.0.*

yannK
Splunk Employee
Splunk Employee

Before Splunk 5.0.0 , when I had results summarized with stats or timechart, the name of the function was converted using underscores. To call the result back I had to use the "_". This changed with 5.*, to call back you need to use the exact function call.

Example :

  • summary generated with a search like "mysummarysearch"

* | timechart span=1h sum(GB) by source

  • in 4.* to call it back I need

index=summary search_name=mysummarysearch earliest=24h | stats sum(sum_GB_) by source

  • in 5.* to call it back I need

index=summary search_name=mysummarysearch earliest=24h | stats sum(sum(GB)) by source

Tags (1)
1 Solution

yannK
Splunk Employee
Splunk Employee

I had to go over my searches and fix them, they were able to retrieve all my data

View solution in original post

yannK
Splunk Employee
Splunk Employee

I had to go over my searches and fix them, they were able to retrieve all my data

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...