Archive

last dont work by chart but its work with avg why?

karakutu
Path Finder

when i use last by chart with if it doenst work
when i replace last with avg its work
oder
when i run only following line: index=main XXX | chart last(UsePct) as PercentFree by MountedOn its work too.

what can be wrong with last()

index=main   XXX | chart last(UsePct) as PercentFree by MountedOn
    | eval redCritical   = if(PercentFree  >= 86,PercentFree  ,0) 
    | eval yellowWarning = if(PercentFree  > 76 AND PercentFree <=85,PercentFree  ,0) 
    | eval  greenOK= if(PercentFree  < 75,PercentFree  ,0) 
    | table MountedOn,redCritical,yellowWarning,greenOK
Tags (1)
0 Karma

adonio
SplunkTrust
SplunkTrust

hello there,
can you elaborate on what is not working?
tried on some internal data and both seems to work fine:

index = _internal sourcetype = splunkd
| eval small_number = b/100
| chart last(small_number) as PercentFree by host
| eval redCritical   = if(PercentFree  >= 86,PercentFree  ,0) 
| eval yellowWarning = if(PercentFree  > 76 AND PercentFree <=85,PercentFree  ,0) 
| eval  greenOK= if(PercentFree  < 75,PercentFree  ,0) 
| table host,redCritical,yellowWarning,greenOK

index = _internal sourcetype = splunkd
| eval small_number = b/100
| chart avg(small_number) as PercentFree by host
| eval redCritical   = if(PercentFree  >= 86,PercentFree  ,0) 
| eval yellowWarning = if(PercentFree  > 76 AND PercentFree <=85,PercentFree  ,0) 
| eval  greenOK= if(PercentFree  < 75,PercentFree  ,0) 
| table host,redCritical,yellowWarning,greenOK

can you verify?
hope it helps

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!