topic Re: appendcols and streamstats with alltime in Splunk Search

appendcols and streamstats with alltime

dataisbeautiful — Mon, 24 Jun 2024 13:06:49 GMT

Hi all

I have a search that works for a range of a few days (eg earliest=-7d@d), but when running for alltime it breaks. I suspect this is an issue with appendcols or streamstats? Any pointers would be appreciated.

I'm using this to generate a lookup which I can then search instead of using an expensive alltime.

index=ndx sourcetype=src (device="PM4") earliest=0 latest=@d | bucket _time span=1d | stats max(value) as PM4Val by _time index | appendcols [ search index=ndx sourcetype=src (device="PM2") earliest=0 latest=@d | bucket _time span=1d | stats max(value) as PM2Val by _time index ] | streamstats current=f last(PM4Val) as LastPM4Val last(PM2Val) as LastPM2Val by index | eval PM4ValDelta = PM4Val - LastPM4Val, PM2ValDelta = PM2Val - LastPM2Val | table _time, index, PM4Val, PM4ValDelta, PM2Val, PM2ValDelta | sort index -_time

Re: appendcols and streamstats with alltime

ITWhisperer — Mon, 24 Jun 2024 13:32:33 GMT

Subsearches are usually limited to 50k events so an alltime subsearch it likely to have been (silently) terminated. Given that your index and source type are the same, try removing the subsearch

index=ndx sourcetype=src (device="PM4" OR device="PM2") earliest=0 latest=@d | bucket _time span=1d | stats max(eval(if(device="PM4",value,null()))) as PM4Val max(eval(if(device="PM2",value,null()))) as PM2Val by _time index

Re: appendcols and streamstats with alltime

dataisbeautiful — Mon, 24 Jun 2024 13:53:17 GMT

Doing an EVAL in STATS has made by day @ITWhisperer

Re: appendcols and streamstats with alltime

PickleRick — Mon, 24 Jun 2024 16:56:13 GMT

50k is the limit on subsearch when used with join command. The "normal" subsearch limit is much lower - it's 10k results.