Reporting

Why is my post process real-time base saved search failing to graph values if I change "where timing < 10" to "fields timing" or "timechart avg(timing)"?

tborup
Engager

I have a dashboard referring a saved search. The search is a real-time search returning the values timing and count by _time. The dashboard works fine until I change "where timing < 10" to "fields timing" or "timechart avg(timing)". After this change, no values are shown in the graph. Can this be explained in any way?

The goal is to use one real-time search on both a graph with two values (timing and count) and a gauge only showing the value of count.

<dashboard>
  <search id="BaseSearch" ref="Request pr.min RT"></search>
  <row>
    <panel>
      <chart>
        <search base="BaseSearch">
          <query>where timing < 10</query>
        </search>
.....

Splunk version: 6.2.3

0 Karma
1 Solution

tborup
Engager

If I change the query part to this

    <search base="BaseSearch">
      <query>fields _time count timing</query>
    </search>

the value timing disappears. This is unexpected, but it gives me the result I want and I am able to show the count value in a gauge.

In case the basesearch is important in giving the answer to this unexpected behavior, I'll provide it here.

`FMK_servers_auditLog` | fields _time processingTime | bin _time span=2s as sek2 | eval sek=strftime(sek2,"%H:%M:%S") | stats count avg(processingTime) as timing by sek | eval count = count*0.5 | eval timing = timing/10

View solution in original post

tborup
Engager

If I change the query part to this

    <search base="BaseSearch">
      <query>fields _time count timing</query>
    </search>

the value timing disappears. This is unexpected, but it gives me the result I want and I am able to show the count value in a gauge.

In case the basesearch is important in giving the answer to this unexpected behavior, I'll provide it here.

`FMK_servers_auditLog` | fields _time processingTime | bin _time span=2s as sek2 | eval sek=strftime(sek2,"%H:%M:%S") | stats count avg(processingTime) as timing by sek | eval count = count*0.5 | eval timing = timing/10
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...