Dashboards & Visualizations

last dont work by chart but its work with avg why?

karakutu
Path Finder

when i use last by chart with if it doenst work
when i replace last with avg its work
oder
when i run only following line: index=main XXX | chart last(UsePct) as PercentFree by MountedOn its work too.

what can be wrong with last()

index=main   XXX | chart last(UsePct) as PercentFree by MountedOn
    | eval redCritical   = if(PercentFree  >= 86,PercentFree  ,0) 
    | eval yellowWarning = if(PercentFree  > 76 AND PercentFree <=85,PercentFree  ,0) 
    | eval  greenOK= if(PercentFree  < 75,PercentFree  ,0) 
    | table MountedOn,redCritical,yellowWarning,greenOK
Tags (1)
0 Karma

adonio
Ultra Champion

hello there,
can you elaborate on what is not working?
tried on some internal data and both seems to work fine:

index = _internal sourcetype = splunkd
| eval small_number = b/100
| chart last(small_number) as PercentFree by host
| eval redCritical   = if(PercentFree  >= 86,PercentFree  ,0) 
| eval yellowWarning = if(PercentFree  > 76 AND PercentFree <=85,PercentFree  ,0) 
| eval  greenOK= if(PercentFree  < 75,PercentFree  ,0) 
| table host,redCritical,yellowWarning,greenOK

index = _internal sourcetype = splunkd
| eval small_number = b/100
| chart avg(small_number) as PercentFree by host
| eval redCritical   = if(PercentFree  >= 86,PercentFree  ,0) 
| eval yellowWarning = if(PercentFree  > 76 AND PercentFree <=85,PercentFree  ,0) 
| eval  greenOK= if(PercentFree  < 75,PercentFree  ,0) 
| table host,redCritical,yellowWarning,greenOK

can you verify?
hope it helps

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...