Splunk Search

License Percentage Used Saved Search returning odd values

wwhitener
Communicator

Greetings,

I have a saved search:

index=_internal sourcetype=splunkd Metrics "group=per_host_thruput" | stats sum(kb) AS Totalkb | Eval GB=round(Totalkb/1048576,2) | eval percent=round(GB/.5 * 100) | TABLE percent

This is tied to the custom time range -24h@d -- to hopefully snap it so that I get the past 24 hours up to 000 hours this morning.

I saved this little query and tried to run it from the command line. I was expecting a single value, but instead got:


Preview of: | savedsearch Percent_Used

percent

------

74

Preview of: | savedsearch Percent_Used

percent

-------

84

percent

-------

2148

I've never seen the previews before upgrading to 4.2.2. I really only need the last value--not the "previews". Is there a way to turn this off with 4.2.2?

Thank you!

0 Karma
1 Solution

wwhitener
Communicator

http://splunk-base.splunk.com/answers/8288/where-is-the-option-to-disable-preview-at-cant-find-it-an... has some good information on this. I ended up going to the search and clicking on the results and found this checkbox.

View solution in original post

0 Karma

wwhitener
Communicator

http://splunk-base.splunk.com/answers/8288/where-is-the-option-to-disable-preview-at-cant-find-it-an... has some good information on this. I ended up going to the search and clicking on the results and found this checkbox.

0 Karma

wwhitener
Communicator

This more or less answered my question--how to get rid of the Preview. I'm marking it as answered.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...