Splunk Search

Why are data model metrics not showing up with this search?

locose
Path Finder

The following searches work :

| tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap_free) AS swap_free FROM datamodel=COY_Performance  WHERE nodename="All_Performance.Memory"  AND All_Performance.dest="hostname-11"

| tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap) AS swap FROM datamodel=COY_Performance  WHERE nodename="All_Performance.Memory"  AND All_Performance.dest="hostname-11"

This doesn’t work

| tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap_used) AS swap_used  FROM datamodel=COY_Performance  WHERE nodename="All_Performance.Memory"  AND All_Performance.dest="hostname-11"

But via the pivot on the datamodel, I do see metrics from "All_Performance.Memory.swap_used".

Any reason why my search returns nothing for

| tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap_used) AS swap_used  FROM datamodel=COY_Performance  WHERE nodename="All_Performance.Memory"  AND All_Performance.dest="hostname-11"
0 Karma

ehudb
Contributor

Try using values() instead of avg(), to check what values are extracting.
Maybe that field configuration in the datamodel was supposed to be a number but was configured as a string?

0 Karma

locose
Path Finder

Values() doesn't work and the field is configured as number

0 Karma

ehudb
Contributor

What do you mean values doesn't work?
What result you get for:

| tstats xxxx_summaries_only values(All_Performance.Memory.swap_used) AS swap_used FROM datamodel=COY_Performance WHERE nodename="All_Performance.Memory" AND All_Performance.dest="hostname-11"

0 Karma

locose
Path Finder

correct.
tstats xxxx_summaries_only values(All_Performance.Memory.swap_used) AS swap_used FROM datamodel=COY_Performance WHERE nodename="All_Performance.Memory" AND All_Performance.dest="hostname-11"

didn't work

0 Karma

ehudb
Contributor

didn't work, but what do you get as a result?

0 Karma

locose
Path Finder

"no results found"

0 Karma

ehudb
Contributor

Try to view the table in the pivot, and click "open in search"
Then inspect the search details and look in search.log
You will find the |tstats that was running in the background

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...