topic Re: Is there a way to dynamically set latest in tstats? in Splunk Search

Is there a way to dynamically set latest in tstats?

fredclown — Wed, 25 May 2022 18:24:22 GMT

I've done this in the past and it works to get data for today up to the latest 5 minute span, but I'm hoping to speed it up with tstats.

index="foo" sourcetype="foo" earliest=-0d@d latest=[|makeresults | eval snap=floor(now()/300)*300 | return $snap] | stats sum(b) as bytes ....

I tried this but it doesn't work.

I could do this potentially but it doesn't seem to be much better and quite frankly is a bit more confusing.

| tstats sum(stuff.b)as bytes from datamodel="mymodel.stuff" where index="foo" sourcetype="foo" earliest=-0d@d by _time span=1min | where _time < floor(now()/300)*300 | rename stuff.* as * | stats sum(bytes) as bytes ....

If there is anyway to do it in the tstats command that would be great ... thoughts?

Re: Is there a way to dynamically set latest in tstats?

somesoni2 — Wed, 25 May 2022 18:14:27 GMT

Try like this

Re: Is there a way to dynamically set latest in tstats?

fredclown — Tue, 31 May 2022 16:54:54 GMT

It's odd. When I run it like that I basically get double the counts, than if I just hard code the values.

Re: Is there a way to dynamically set latest in tstats?

VatsalJagani — Tue, 31 May 2022 17:06:26 GMT

@fredclown - Please check the job inspector to see are you getting the proper latest value as you expect or not.