topic How to display last 24 hours data with query? in Splunk Search

How to display last 24 hours data with query?

geetanjali — Mon, 28 Sep 2020 09:34:20 GMT

Hi,
i have my results :

Host | max(usage)

ABC | 100

xyz | 200

I want to add new column in table with max(usage) in last 24 hours by host.

| Max usage (last 24 hours)

| 90

| 200

I am using following query :
index="power" sourcetype="power_usage" | join [ search index="power" sourcetype="power_usage" earliest=-24h | stats max(Power_consumption) by host ]| chart max(Power_consumption) over host

Following error occur wit the query:-
[subsearch]: Your timerange was substituted based on your search string

If any body knows the solution, please let me know.

Thanks in advance.

Re: How to display last 24 hours data with query?

OL — Tue, 17 May 2011 13:45:22 GMT

Hello,

I don't have the answer, but I can see a problem with the join function. It needs the field-list parameter as you can see in http://www.splunk.com/base/Documentation/latest/SearchReference/Join. In other word, you need to join your subsearch to something and the "field-list" is the common link between both search.

Hope it helps.

Regards,
Olivier

Re: How to display last 24 hours data with query?

OL — Tue, 17 May 2011 13:54:05 GMT

By the way, have you tried the eventstats function? It attaches a summary statistics to each event.

Regards,
Olivier

Re: How to display last 24 hours data with query?

MarioM — Tue, 17 May 2011 13:59:55 GMT

Olivier is right eventstats might be a more appropriate command than "join" i suggested to you in another thread