Getting Data In

Why is Splunk rest api result not returning aggregated field?

santoshbwn
New Member
search index=abc dp_"response"| stats perc95(api_time_taken) as abc by api

 

This is the search query I am using while invoking through splunk rest API.

In the result, I am not getting the abc field, only the API values are listed . Is there anything specific I need to do to include perc95,avg or max values in the result.

 

From UI, it works completely fine where it shows the abc column with the 95 percentile value

If someone can guide me, it would be really helpful.

 

Thanks,

Santosh

Thank,

Santosh

0 Karma

kilimche
Explorer

Hi, @santoshbwn any update on your issue?

0 Karma

kilimche
Explorer

Hi, any update on your issue, Im facing similar problem when reading from SPLUNK Rest APi via ADF using 

| eval compliant=if(Days<60, "Yes", "No")]
| chart count(host) by system compliant | addtotals | eval No=round((100*No/Total),2) | eval Yes=round((100*Yes/Total),2) | fields – Total Yes No

 

I see the correct result via UI but only the summary in the ADF result

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...