topic Re: Filtering data prior to timechart - finding values that are outside of filter in Splunk Search

Filtering data prior to timechart - finding values that are outside of filter

codekiln — Mon, 09 Aug 2021 21:00:10 GMT

I'm seeking to make a spunk timechart of values that match a certain filter:

source="/var/log/bcore/ws_metric*" event="WsMetricConnectEventType.connect_end" duration_seconds < 60*60 | timechart p95(duration_seconds) span=5m

Unfortunately, I'm clearly getting values that are longer than 60*60=3600 seconds. Many of the values for p95(duration_seconds) are actually somewhere in the range of 397k seconds.

How can I actually filter the data going into timechart?

Re: Filtering data prior to timechart - finding values that are outside of filter

richgalloway — Tue, 10 Aug 2021 00:19:40 GMT

You can't do math in the search command. Try where, instead or do the math yourself.

source="/var/log/bcore/ws_metric*" vent="WsMetricConnectEventType.connect_end" duration_seconds < 3600 | timechart p95(duration_seconds) span=5m source="/var/log/bcore/ws_metric*" vent="WsMetricConnectEventType.connect_end" | where duration_seconds < 60*60 | timechart p95(duration_seconds) span=5m