Splunk Search

What is the meaning of the following statement?

Explorer

In the following search:

index=_internal source=*metrics.log group="per_host_thruput" | eval GB=kb/1048576 | stats sum(GB) as total by series | addinfo | eval days = (info_max_time - info_min_time) / 86400 | fields - info* | eval daily_average = total / days

What does the "fields - info*" do?

Thanks.

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi,

It will remove all fields starting with info from results. When you use | addinfo command it will add info_max_time, info_min_time, info_search_time and info_sid fields. So when you add | fields - info* it will remove all these fields from results.

View solution in original post

0 Karma

Revered Legend

Your query before the | addinfo command calculates the amount of data sent by each host in GB. The | addinfo adds many info* fields in the search which includes the time range (the info_min_time i.e. earliest and info_max_time i.e. latest). You're using those time range epoch valued fields to get number of days in your time range. Once the number of days are calculate, you're removing those info* fields as you don't want to show them, by using | fields - info*.

0 Karma

Explorer

Thanks...!

0 Karma

SplunkTrust
SplunkTrust

Hi,

It will remove all fields starting with info from results. When you use | addinfo command it will add info_max_time, info_min_time, info_search_time and info_sid fields. So when you add | fields - info* it will remove all these fields from results.

View solution in original post

0 Karma

Explorer

Thanks. That makes sense. 🙂

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!