Getting Data In
Highlighted

Metrics Index - How to get metric_searchtime field value in search result

New Member

I uploaded a csv file in metric index. I can see index's data there is no issue in that.

My query is:
I want to get metrictimestamp in search query to perform some action on that. Is it possible to use "metrictimestamp" field in mstat commands? I always get error whenever I tried to apply any statistical function (i.e. latest etc) on "metrictimestamp" or used it as a dimension field (where index=xyz by metrictimestamp).

mcatalog just displays the schema, not the values from "metric_timestamp" field.

Any help is greatly appreciated. Thanks!

0 Karma
Highlighted

Re: Metrics Index - How to get metric_searchtime field value in search result

Path Finder

For mstats to project by time you need to give it a span, so queries of the form:

| mstats avg("abc") WHERE index="xyz" span=10s

It's not possible to aggregate time, so you can't do things like latest("_time").

View solution in original post

0 Karma
Highlighted

Re: Metrics Index - How to get metric_searchtime field value in search result

New Member

Thanks for quick response Thaggie. So, we cannot use this field "metric_timestamp" in anywhere in our search except spanning the chart based on it.

0 Karma
Highlighted

Re: Metrics Index - How to get metric_searchtime field value in search result

Path Finder

That's right

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.