Splunk Search

Timechart not working after multikv

johnsasikumar
Path Finder

Hi, I am not sure why timechart does not work for me. I would like a timechart for avg memory used.
I tried the below search:

source=vmstat 
| multikv fields memFreeMB
| timechart span=1h avg(memFreeMB)

the field avg(memFreeMB) is null.

I tried:

source=vmstat 
| multikv fields memFreeMB
| table _time memFreeMB

Which works but it's not a timechart. I tried using an eval command to create a new field =memFreeMB.
But no luck could someone help me with this.
I need a timechart for further analysis

0 Karma

somesoni2
Revered Legend

Your multikv command is limiting the available fields to be just memFreeMB. You need _time field in order to generate timechart. So give this a try

source=vmstat 
| multikv fields _time memFreeMB
| timechart span=1h avg(memFreeMB)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!