when i use last by chart with if it doenst work
when i replace last with avg its work
oder
when i run only following line: index=main XXX | chart last(UsePct) as PercentFree by MountedOn its work too.
what can be wrong with last()
index=main XXX | chart last(UsePct) as PercentFree by MountedOn
| eval redCritical = if(PercentFree >= 86,PercentFree ,0)
| eval yellowWarning = if(PercentFree > 76 AND PercentFree <=85,PercentFree ,0)
| eval greenOK= if(PercentFree < 75,PercentFree ,0)
| table MountedOn,redCritical,yellowWarning,greenOK
hello there,
can you elaborate on what is not working?
tried on some internal data and both seems to work fine:
index = _internal sourcetype = splunkd
| eval small_number = b/100
| chart last(small_number) as PercentFree by host
| eval redCritical = if(PercentFree >= 86,PercentFree ,0)
| eval yellowWarning = if(PercentFree > 76 AND PercentFree <=85,PercentFree ,0)
| eval greenOK= if(PercentFree < 75,PercentFree ,0)
| table host,redCritical,yellowWarning,greenOK
index = _internal sourcetype = splunkd
| eval small_number = b/100
| chart avg(small_number) as PercentFree by host
| eval redCritical = if(PercentFree >= 86,PercentFree ,0)
| eval yellowWarning = if(PercentFree > 76 AND PercentFree <=85,PercentFree ,0)
| eval greenOK= if(PercentFree < 75,PercentFree ,0)
| table host,redCritical,yellowWarning,greenOK
can you verify?
hope it helps