Splunk Search

Not getting data for all day

twh1
Communicator

I am running timechart command for sum of free space and used space with span of 1 day. I am missing data for few days. but when I am running the same command on those specific date, I am getting data.

Below command for last 7 days.

base search | timechart span=1d sum(Used_Space_GB) as "Used Space", sum(Free_Space_GB) as "Free Space" 
_time           Used Space           Free Space
2019-02-06       0.03                    0.95
2019-02-07       3744.03             2575.97
2019-02-08      56946.22            122232.70
2019-02-09      0                           0
2019-02-10      0                           0
2019-02-11     19.00                   2330.00
2019-02-12     0                          0
2019-02-13    399369.75      791924.36

but when I am running the same query for 12th Feb 2019. I am getting below result.

base search | timechart span=1d sum(Used_Space_GB) as "Used Space", sum(Free_Space_GB) as "Free Space"
_time                Used Space Free Space
2019-02-12 00:00:00 398641.91   792654.95
0 Karma
1 Solution

twh1
Communicator

I have removed the dedup from host and got the desired output.

View solution in original post

0 Karma

twh1
Communicator

I have removed the dedup from host and got the desired output.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

I downvoted this post because your original post doesn't even mention dedup... this solution helps no future people who come across this question

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

I think your query should be using avg instead of sum:

Try this: base search | timechart span=1d avg(Used_Space_GB) as "Used Space", avg(Free_Space_GB) as "Free Space"

This is becuase there are probably a few monitoring points per day

As for why the 12th is different, I am not sure...

twh1
Communicator

Hi @chrisyoungerjds ,
I want the sum of free space and sum of used space with daily span.

0 Karma

woodcock
Esteemed Legend

It is highly unlikely that your logs are giving you delta values. I have never seen any disk usage tool present data in such a way. If you are getting deltas, then sum is correct. However, if the logs are giving you current state, then you should be using avg. Take a good hard look at the logs and the source of them. I am sure that @chrisyoungerjds is correct.

chrisyounger
SplunkTrust
SplunkTrust

how often are the raw events arriving? are they on a daily basis? is the time the measurement take at midnight - if so, does the exact time drift a little which causes the days to not add up properly?

0 Karma

twh1
Communicator

data is coming every 10 min.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...