https://community.splunk.com/t5/Splunk-Search/Selecting-which-fields-to-plot-based-on-subsearch/m-p/143096#M39733 <P>Hi,<BR /> I am trying to create a timechart which data would be based on a subsearch. Here is what I have so far : </P> <PRE><CODE>index=perf_mon test_nvidia | | timechart bins=100 [search | rex mode=sed field=gpus "s/GPU(\d+)/avg(mem_used\1_GB) as GPU\1,/g" | nomv gpus | rename gpus as search| format "" "" "" "" "" "by host" | rex mode=sed field=search "s/\"//g"] </CODE></PRE> <P>The first search yields fields named</P> <PRE><CODE>mem_used0_GB ... mem_used7_GB </CODE></PRE> <P>Now, the subsearch </P> <PRE><CODE>| rex mode=sed field=gpus "s/GPU(\d+)/avg(mem_used\1_GB) as GPU\1,/g" | nomv gpus | rename gpus as search| format "" "" "" "" "" "by host" | rex mode=sed field=search "s/\"//g" produces a single field called "search", which contains : avg(mem_used4_GB) as GPU4, avg(mem_used5_GB) as GPU5, by host </CODE></PRE> <P>However, when I add the subsearch to the timechart command, Splunk gives me the error : </P> <PRE><CODE>Error in 'timechart' command: The argument ' avg(mem_used5_GB)' is invalid. </CODE></PRE> <P>What am I doing wrong ?</P> Thu, 04 Dec 2014 14:49:28 GMT mboisson 2014-12-04T14:49:28Z https://community.splunk.com/t5/Splunk-Search/Selecting-which-fields-to-plot-based-on-subsearch/m-p/143096#M39733 <P>Hi,<BR /> I am trying to create a timechart which data would be based on a subsearch. Here is what I have so far : </P> <PRE><CODE>index=perf_mon test_nvidia | | timechart bins=100 [search | rex mode=sed field=gpus "s/GPU(\d+)/avg(mem_used\1_GB) as GPU\1,/g" | nomv gpus | rename gpus as search| format "" "" "" "" "" "by host" | rex mode=sed field=search "s/\"//g"] </CODE></PRE> <P>The first search yields fields named</P> <PRE><CODE>mem_used0_GB ... mem_used7_GB </CODE></PRE> <P>Now, the subsearch </P> <PRE><CODE>| rex mode=sed field=gpus "s/GPU(\d+)/avg(mem_used\1_GB) as GPU\1,/g" | nomv gpus | rename gpus as search| format "" "" "" "" "" "by host" | rex mode=sed field=search "s/\"//g" produces a single field called "search", which contains : avg(mem_used4_GB) as GPU4, avg(mem_used5_GB) as GPU5, by host </CODE></PRE> <P>However, when I add the subsearch to the timechart command, Splunk gives me the error : </P> <PRE><CODE>Error in 'timechart' command: The argument ' avg(mem_used5_GB)' is invalid. </CODE></PRE> <P>What am I doing wrong ?</P> Thu, 04 Dec 2014 14:49:28 GMT https://community.splunk.com/t5/Splunk-Search/Selecting-which-fields-to-plot-based-on-subsearch/m-p/143096#M39733 mboisson 2014-12-04T14:49:28Z https://community.splunk.com/t5/Splunk-Search/Selecting-which-fields-to-plot-based-on-subsearch/m-p/143097#M39734 <P>I have not managed to do it within the timechart command. However, it works if I first do it in a "fields" command, aka : </P> <PRE><CODE>index=perf_mon test_nvidia | fields [search ... ],_*,host | timechart ... </CODE></PRE> Thu, 04 Dec 2014 15:51:11 GMT https://community.splunk.com/t5/Splunk-Search/Selecting-which-fields-to-plot-based-on-subsearch/m-p/143097#M39734 mboisson 2014-12-04T15:51:11Z