All Apps and Add-ons

Values from lookup are not displaying after using timechart, chart, or stats.

pratapbhanu2047
Engager

Hello,

I am not sure where i committing mistake, the Below SPL, does display all counter and the values. when i use max* in table but it does not show the values from my lookup files.(i.e : type environment sub_system)

index=n_*_1* collection="*" host=* collection="Host*" source="perfmon:Host*" AND source!="Perfmon:Host Process" | lookup lookup_list_host host output type environment sub_system | eval Value=round(Value) | eval my{counter}=Value | bin span=5min _time |stats max(my*) by _time |table _time type environment sub_system max*

the whole point is aggregating counter and its values(which i did by using eval my{counter}=Value) every 5min and displaying the result as in table format (i.e : table _time type environment sub_system max*) so that i can use this data to work further on building machine learning models.

0 Karma
1 Solution

Ayn
Legend

stats is a consuming command - it will only output what you've specifically told it to output. All the rest of the stuff that it receives as input is gone after it. So when you run stats max(my*) by _time, the only fields that will be available after that are _time (because you're splitting by it) and all the my* fields (because you're running max() on them).

If you want to perform the stats calculations but not consume all other input, use eventstats instead. It will do the same thing but instead just write its results to the specified fields and leave the rest of the available data as-is.

View solution in original post

Ayn
Legend

stats is a consuming command - it will only output what you've specifically told it to output. All the rest of the stuff that it receives as input is gone after it. So when you run stats max(my*) by _time, the only fields that will be available after that are _time (because you're splitting by it) and all the my* fields (because you're running max() on them).

If you want to perform the stats calculations but not consume all other input, use eventstats instead. It will do the same thing but instead just write its results to the specified fields and leave the rest of the available data as-is.

View solution in original post

somesoni2
Revered Legend

Or include them in by clause of your stats.

0 Karma

pratapbhanu2047
Engager

@Ayn & @somesoni2, thanks for response, yes i followed the same and its working. I have added other field in by clause of stats.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!