Splunk Search

Need help on appendcols _time issue

jip31
Motivator

hello

When I run the search below, its gives me "4" in results at the _time span = 11h

 

`index`  earliest=@d+7h latest=@d+19h 
| bin _time span=1h 
 | stats dc(sign_id) as "Signal inc" by _time

 

 

jip31_0-1648036551795.png

But

 

`index` earliest=@d+7h latest=@d+19h 
| stats avg(citrix) as citrix by sam _time 
| eval PbPerf=if(citrix>200,1,0) 
| search PbPerf > 0 
| bin _time span=1h 
| stats dc(sam) as "W" by _time 
| appendcols 
    [ search `index` earliest=@d+7h latest=@d+19h 
    | bin _time span=1h 
    | stats count as W by _time] 
| appendcols 
    [ search `index` earliest=@d+7h latest=@d+19h 
    | bin _time span=1h 
    | stats dc(signaler_id) as "Signal inc" by _time ] 
| appendcols 
    [ search `index` earliest=@d+7h latest=@d+19h 
    | bin _time span=1h 
    | stats count as "TEA" by _time] 
| fillnull value=0 
| eval time=strftime(_time,"%H:%M") 
| sort time 
| fields - _time _span _origtime 
| transpose 0 header_field=time column_name=KPI 
| sort + KPI

 

 my problem is that I must use this search with other search in order to display results by _time span

So when I execute this search with other searches, the results for th primary search is always 4 but it's display the _time span = 11h but for the _time span= 8h!!!

whats is the problem please? 

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

As you know, appendcols does not correlate the values in the rows, it just adds data rows in the order returned i.e. the first row returned will be added to the first row of the current set, this means the results can get out of line. Try using timechart which will generate the "missing" time periods.

`index` earliest=@d+7h latest=@d+19h 
| stats avg(citrix) as citrix by sam _time 
| eval PbPerf=if(citrix>200,1,0) 
| search PbPerf > 0 
| timechart span=1h dc(sam) as "W"
| appendcols 
    [ search `index` earliest=@d+7h latest=@d+19h 
    | timechart span=1h count as W] 
| appendcols 
    [ search `index` earliest=@d+7h latest=@d+19h 
    | timechart span=1h dc(signaler_id) as "Signal inc" ] 
| appendcols 
    [ search `index` earliest=@d+7h latest=@d+19h 
    | timechart span=1h count as "TEA"] 
| fillnull value=0 
| eval time=strftime(_time,"%H:%M") 
| sort time 
| fields - _time _span _origtime 
| transpose 0 header_field=time column_name=KPI 
| sort + KPI

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

As you know, appendcols does not correlate the values in the rows, it just adds data rows in the order returned i.e. the first row returned will be added to the first row of the current set, this means the results can get out of line. Try using timechart which will generate the "missing" time periods.

`index` earliest=@d+7h latest=@d+19h 
| stats avg(citrix) as citrix by sam _time 
| eval PbPerf=if(citrix>200,1,0) 
| search PbPerf > 0 
| timechart span=1h dc(sam) as "W"
| appendcols 
    [ search `index` earliest=@d+7h latest=@d+19h 
    | timechart span=1h count as W] 
| appendcols 
    [ search `index` earliest=@d+7h latest=@d+19h 
    | timechart span=1h dc(signaler_id) as "Signal inc" ] 
| appendcols 
    [ search `index` earliest=@d+7h latest=@d+19h 
    | timechart span=1h count as "TEA"] 
| fillnull value=0 
| eval time=strftime(_time,"%H:%M") 
| sort time 
| fields - _time _span _origtime 
| transpose 0 header_field=time column_name=KPI 
| sort + KPI
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...