Reporting

Why is my post process real-time base saved search failing to graph values if I change "where timing < 10" to "fields timing" or "timechart avg(timing)"?

tborup
Engager

I have a dashboard referring a saved search. The search is a real-time search returning the values timing and count by _time. The dashboard works fine until I change "where timing < 10" to "fields timing" or "timechart avg(timing)". After this change, no values are shown in the graph. Can this be explained in any way?

The goal is to use one real-time search on both a graph with two values (timing and count) and a gauge only showing the value of count.

<dashboard>
  <search id="BaseSearch" ref="Request pr.min RT"></search>
  <row>
    <panel>
      <chart>
        <search base="BaseSearch">
          <query>where timing < 10</query>
        </search>
.....

Splunk version: 6.2.3

0 Karma
1 Solution

tborup
Engager

If I change the query part to this

    <search base="BaseSearch">
      <query>fields _time count timing</query>
    </search>

the value timing disappears. This is unexpected, but it gives me the result I want and I am able to show the count value in a gauge.

In case the basesearch is important in giving the answer to this unexpected behavior, I'll provide it here.

`FMK_servers_auditLog` | fields _time processingTime | bin _time span=2s as sek2 | eval sek=strftime(sek2,"%H:%M:%S") | stats count avg(processingTime) as timing by sek | eval count = count*0.5 | eval timing = timing/10

View solution in original post

tborup
Engager

If I change the query part to this

    <search base="BaseSearch">
      <query>fields _time count timing</query>
    </search>

the value timing disappears. This is unexpected, but it gives me the result I want and I am able to show the count value in a gauge.

In case the basesearch is important in giving the answer to this unexpected behavior, I'll provide it here.

`FMK_servers_auditLog` | fields _time processingTime | bin _time span=2s as sek2 | eval sek=strftime(sek2,"%H:%M:%S") | stats count avg(processingTime) as timing by sek | eval count = count*0.5 | eval timing = timing/10
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...