Knowledge Management

summary stats functions call back changed in 5.0.*

yannK
Splunk Employee
Splunk Employee

Before Splunk 5.0.0 , when I had results summarized with stats or timechart, the name of the function was converted using underscores. To call the result back I had to use the "_". This changed with 5.*, to call back you need to use the exact function call.

Example :

  • summary generated with a search like "mysummarysearch"

* | timechart span=1h sum(GB) by source

  • in 4.* to call it back I need

index=summary search_name=mysummarysearch earliest=24h | stats sum(sum_GB_) by source

  • in 5.* to call it back I need

index=summary search_name=mysummarysearch earliest=24h | stats sum(sum(GB)) by source

Tags (1)
1 Solution

yannK
Splunk Employee
Splunk Employee

I had to go over my searches and fix them, they were able to retrieve all my data

View solution in original post

yannK
Splunk Employee
Splunk Employee

I had to go over my searches and fix them, they were able to retrieve all my data

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...