Splunk Search

Using a field to supply latest

msarro
Builder

Greetings all. I am trying to use the earliest and latest fields to filter out some event data. This is for the purpose of creating an average and standard deviation for the week prior to an event occurring, thus giving me a rolling average that I can compare certain field values to, and see how many standard deviations away from the average the field falls.

Here is the code I originally used in my subsearch:

|join type=left host [search index=sandbox sourcetype="PSBC_SevOne" earliest=-1w@h |stats avg(GLOBAL_CALLS_PER_SECOND) AS PSBC_AVG_CPS stdevp(GLOBAL_CALLS_PER_SECOND) AS PSBC_STDEVP_CPS avg(GLOBAL_CONCURRENT_SESSIONS) AS PSBC_AVG_GCS stdevp(GLOBAL_CONCURRENT_SESSIONS) AS PSBC_STDEVP_GCS by host]

I would like to modify it to something similar to this:

|join type=left host [search index=sandbox sourcetype="PSBC_SevOne" earliest=-1w@h latest=_time |stats avg(GLOBAL_CALLS_PER_SECOND) AS PSBC_AVG_CPS stdevp(GLOBAL_CALLS_PER_SECOND) AS PSBC_STDEVP_CPS avg(GLOBAL_CONCURRENT_SESSIONS) AS PSBC_AVG_GCS stdevp(GLOBAL_CONCURRENT_SESSIONS) AS PSBC_STDEVP_GCS by host]

However whenever I try to do this it tells me that _time is an invalid entry. Is there any way to get this sort of functionality? I know that when running backfill to pipe the results to a summary index this will work, however for my development environment it can display potentially misleading results.

Tags (1)
0 Karma

LCM
Contributor

I'm not that familiar with this topic, but is that even possible (latest=_time)? The docu itself doesn't mention that! I guess you more have to use something like earliest=-1w@h latest=-0w@h

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...