topic Re: Not getting data for all day in Splunk Search

Not getting data for all day

twh1 — Wed, 13 Feb 2019 10:26:24 GMT

I am running timechart command for sum of free space and used space with span of 1 day. I am missing data for few days. but when I am running the same command on those specific date, I am getting data.

Below command for last 7 days.

base search | timechart span=1d sum(Used_Space_GB) as "Used Space", sum(Free_Space_GB) as "Free Space" 
_time           Used Space           Free Space
2019-02-06       0.03                    0.95
2019-02-07       3744.03             2575.97
2019-02-08      56946.22            122232.70
2019-02-09      0                           0
2019-02-10      0                           0
2019-02-11     19.00                   2330.00
2019-02-12     0                          0
2019-02-13    399369.75      791924.36

but when I am running the same query for 12th Feb 2019. I am getting below result.

base search | timechart span=1d sum(Used_Space_GB) as "Used Space", sum(Free_Space_GB) as "Free Space"
_time                Used Space Free Space
2019-02-12 00:00:00 398641.91   792654.95

Re: Not getting data for all day

chrisyounger — Wed, 13 Feb 2019 10:48:05 GMT

I think your query should be using avg instead of sum:

Try this: base search | timechart span=1d avg(Used_Space_GB) as "Used Space", avg(Free_Space_GB) as "Free Space"

This is becuase there are probably a few monitoring points per day

As for why the 12th is different, I am not sure...

Re: Not getting data for all day

twh1 — Wed, 13 Feb 2019 11:25:43 GMT

Hi @chrisyoungerjds ,
I want the sum of free space and sum of used space with daily span.

Re: Not getting data for all day

chrisyounger — Wed, 13 Feb 2019 11:30:10 GMT

how often are the raw events arriving? are they on a daily basis? is the time the measurement take at midnight - if so, does the exact time drift a little which causes the days to not add up properly?

Re: Not getting data for all day

twh1 — Wed, 13 Feb 2019 13:13:22 GMT

data is coming every 10 min.

Re: Not getting data for all day

woodcock — Wed, 13 Feb 2019 17:17:58 GMT

It is highly unlikely that your logs are giving you delta values. I have never seen any disk usage tool present data in such a way. If you are getting deltas, then sum is correct. However, if the logs are giving you current state, then you should be using avg. Take a good hard look at the logs and the source of them. I am sure that @chrisyoungerjds is correct.

Re: Not getting data for all day

twh1 — Tue, 19 Feb 2019 11:23:35 GMT

I have removed the dedup from host and got the desired output.

Re: Not getting data for all day

chrisyounger — Tue, 19 Feb 2019 11:29:00 GMT

I downvoted this post because your original post doesn't even mention dedup... this solution helps no future people who come across this question