topic Re: Missing data after I increase the numeric data in my where clause in Splunk Search

Missing data after I increase the numeric data in my where clause

cquinney — Tue, 26 Feb 2019 22:43:50 GMT

Greetings

I'm using the following query over 24hrs.

| initial search
| timechart useother=f span=1h avg(field1) by field2 where avg > 100
| fields - NULL

And I get results for that meet that criteria, but when I increase the numeric value from > 100 to > 400, I get zero results even though I should see at least one or two fields from "field2" populate. Any thoughts on what is causing my dilemma?

Re: Missing data after I increase the numeric data in my where clause

lakshman239 — Wed, 27 Feb 2019 16:20:40 GMT

Pls change your search as below and re-test

 initial search
| timechart useother=f span=1h avg(field1) AS avg by field2 where avg > 100

Re: Missing data after I increase the numeric data in my where clause

cquinney — Wed, 27 Feb 2019 16:36:17 GMT

Thank you for the suggestion, but the data still disappears when I increase the numeric value to 200 even though there should be results.

Re: Missing data after I increase the numeric data in my where clause

lakshman239 — Wed, 27 Feb 2019 16:41:55 GMT

do you see avg more than 200 when you run

  initial search
 | timechart useother=f span=1h avg(field1) AS avg by field2  | where avg > 100

Re: Missing data after I increase the numeric data in my where clause

cquinney — Wed, 27 Feb 2019 16:45:49 GMT

No, nothing populates regardless of the numeric value when I pipe the where clause to its own line I'm afraid.

Re: Missing data after I increase the numeric data in my where clause

Vijeta — Wed, 27 Feb 2019 17:03:33 GMT

Try-

 | timechart limit=0 span=1h avg(field1) AS avg by field2  | where avg > 200

Re: Missing data after I increase the numeric data in my where clause

cquinney — Wed, 27 Feb 2019 17:09:48 GMT

Thank you for the suggestion but that doesn't seem to work either.

Re: Missing data after I increase the numeric data in my where clause

lakshman239 — Wed, 27 Feb 2019 17:18:58 GMT

you could do something like this

initial search
| stats avg(field1) AS avg by _time, field2 | where avg > 100 | xyseries _time field2 sum

Re: Missing data after I increase the numeric data in my where clause

cquinney — Wed, 27 Feb 2019 17:24:58 GMT

That will actually work for what I'm trying to accomplish, thank you!

Re: Missing data after I increase the numeric data in my where clause

lakshman239 — Wed, 27 Feb 2019 17:28:03 GMT

pls accept the answer to close tracking.