Hello All,
I am calculating burnrate in splunk, and using addinfo for enrichment to display it on the dashboard.
Burnrate is getting calculated but previous day burnrate is not getting stored which splunk could refer.
I am running the report and pushing the values to it using outputlookup command, & from there below script is reading it.
In Dev environment its working fine, but when I am moving to production its breaking, the values are getting calculated but nit getting saved and burnrate values are not getting connected as per below graph.
Here is the script
| inputlookup append=t lkp_add.csv | addinfo
| eval timestamp=if(isnull(timestamp),round(strptime(date + " 23:59:59","%Y-%m-%d %H:%M:%S"), 0), timestamp), threshold=1
| where desc="add info" and timestamp>=(now()-(info_max_time-info_min_time))
| stats max(burnrate) as burnrate max(threshold) as threshold by timestamp
| eval _time=strptime(timestamp,"%s") | timechart max(burnrate) as burnrate max(threshold) as threshold
