Splunk Search

Missing data after I increase the numeric data in my where clause

Path Finder

Greetings

I'm using the following query over 24hrs.

| initial search
| timechart useother=f span=1h avg(field1) by field2 where avg > 100
| fields - NULL

And I get results for that meet that criteria, but when I increase the numeric value from > 100 to > 400, I get zero results even though I should see at least one or two fields from "field2" populate. Any thoughts on what is causing my dilemma?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

you could do something like this

initial search
| stats avg(field1) AS avg by _time, field2 | where avg > 100 | xyseries _time field2 sum

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

you could do something like this

initial search
| stats avg(field1) AS avg by _time, field2 | where avg > 100 | xyseries _time field2 sum

View solution in original post

0 Karma

Path Finder

That will actually work for what I'm trying to accomplish, thank you!

0 Karma

Influencer

Try-

 | timechart limit=0 span=1h avg(field1) AS avg by field2  | where avg > 200
0 Karma

Path Finder

Thank you for the suggestion but that doesn't seem to work either.

0 Karma

SplunkTrust
SplunkTrust

pls accept the answer to close tracking.

0 Karma

SplunkTrust
SplunkTrust

Pls change your search as below and re-test

 initial search
| timechart useother=f span=1h avg(field1) AS avg by field2 where avg > 100
0 Karma

Path Finder

Thank you for the suggestion, but the data still disappears when I increase the numeric value to 200 even though there should be results.

0 Karma

SplunkTrust
SplunkTrust

do you see avg more than 200 when you run

  initial search
 | timechart useother=f span=1h avg(field1) AS avg by field2  | where avg > 100
0 Karma

Path Finder

No, nothing populates regardless of the numeric value when I pipe the where clause to its own line I'm afraid.

0 Karma