Dashboards & Visualizations

last dont work by chart but its work with avg why?

karakutu
Path Finder

when i use last by chart with if it doenst work
when i replace last with avg its work
oder
when i run only following line: index=main XXX | chart last(UsePct) as PercentFree by MountedOn its work too.

what can be wrong with last()

index=main   XXX | chart last(UsePct) as PercentFree by MountedOn
    | eval redCritical   = if(PercentFree  >= 86,PercentFree  ,0) 
    | eval yellowWarning = if(PercentFree  > 76 AND PercentFree <=85,PercentFree  ,0) 
    | eval  greenOK= if(PercentFree  < 75,PercentFree  ,0) 
    | table MountedOn,redCritical,yellowWarning,greenOK
Tags (1)
0 Karma

adonio
Ultra Champion

hello there,
can you elaborate on what is not working?
tried on some internal data and both seems to work fine:

index = _internal sourcetype = splunkd
| eval small_number = b/100
| chart last(small_number) as PercentFree by host
| eval redCritical   = if(PercentFree  >= 86,PercentFree  ,0) 
| eval yellowWarning = if(PercentFree  > 76 AND PercentFree <=85,PercentFree  ,0) 
| eval  greenOK= if(PercentFree  < 75,PercentFree  ,0) 
| table host,redCritical,yellowWarning,greenOK

index = _internal sourcetype = splunkd
| eval small_number = b/100
| chart avg(small_number) as PercentFree by host
| eval redCritical   = if(PercentFree  >= 86,PercentFree  ,0) 
| eval yellowWarning = if(PercentFree  > 76 AND PercentFree <=85,PercentFree  ,0) 
| eval  greenOK= if(PercentFree  < 75,PercentFree  ,0) 
| table host,redCritical,yellowWarning,greenOK

can you verify?
hope it helps

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...