Splunk Search

License Percentage Used Saved Search returning odd values

wwhitener
Communicator

Greetings,

I have a saved search:

index=_internal sourcetype=splunkd Metrics "group=per_host_thruput" | stats sum(kb) AS Totalkb | Eval GB=round(Totalkb/1048576,2) | eval percent=round(GB/.5 * 100) | TABLE percent

This is tied to the custom time range -24h@d -- to hopefully snap it so that I get the past 24 hours up to 000 hours this morning.

I saved this little query and tried to run it from the command line. I was expecting a single value, but instead got:


Preview of: | savedsearch Percent_Used

percent

------

74

Preview of: | savedsearch Percent_Used

percent

-------

84

percent

-------

2148

I've never seen the previews before upgrading to 4.2.2. I really only need the last value--not the "previews". Is there a way to turn this off with 4.2.2?

Thank you!

0 Karma
1 Solution

wwhitener
Communicator

http://splunk-base.splunk.com/answers/8288/where-is-the-option-to-disable-preview-at-cant-find-it-an... has some good information on this. I ended up going to the search and clicking on the results and found this checkbox.

View solution in original post

0 Karma

wwhitener
Communicator

http://splunk-base.splunk.com/answers/8288/where-is-the-option-to-disable-preview-at-cant-find-it-an... has some good information on this. I ended up going to the search and clicking on the results and found this checkbox.

0 Karma

wwhitener
Communicator

This more or less answered my question--how to get rid of the Preview. I'm marking it as answered.

0 Karma
Get Updates on the Splunk Community!

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Dashboard Challenge and Watch the .conf24 Global Broadcast!

The Splunk Community Dashboard Challenge is still happening, and it's not too late to enter for the week of ...