Hello gents and ladies,
I am trying to write response time P98 to summary index.
| stats p98(response_time)
and get a nice result of 0.040sec. But if I do this:
| sistats p98(response_time)
and get psrsvd_nx_response_time
Why does SPLUNK not save the number in summary indexer like I want it to and instead saves that odd hash?
Appreciate any help. Thanks in advance.
sistats saves preliminary results to the summary index,
stats gives you human-readable numbers. Use
stats to retrieve data from summary indexes that has been calculated using
It's not an unusable hash, it's a preliminary result. In order to pre-compute preliminary results for things like percentile values you need to store more than a simple number, you need to store a distribution of values.
stats knows how to deal with these preliminary results and should do the right thing.
Thanks for that. This is true but when I save the odd hash into the summary index I can not read it.
If I use:
| sistats avg(response_time)
| sistats min(response_time)
| sistats max(response_time)
it saves a usable number into the summary index. Only the p98 saves the odd unusable hash I have above.