mstats produces 2 buckets when span and time picker are both equal

New Member

hi i ran a search to calculate 95th percentile in a 7 day span and output in a single bucket the result:

| mstats p95(_value) as p95 WHERE metric_name="Network_Interface.Bytes_Received/sec" AND "index"="win_em_metrics" span=7d

i had my time picker set to 7 days ago. however i'm getting two result buckets:

_time p95
2019-05-07 92721.795365
2019-05-14 109483.252954

i tried to use _time >= strptime("2018-05-08 00:00:00", "%Y-%m-%d %H:%M:%S") AND _time <= strptime("2018-05-14 23:59:59", "%Y-%m-%d %H:%M:%S") instead of span=7d, but i get a "term based search is not supported" message

appreciate very much for any help. thnx

Tags (1)
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!