Splunk Search
Highlighted

Why are data model metrics not showing up with this search?

Path Finder

The following searches work :

| tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap_free) AS swap_free FROM datamodel=COY_Performance  WHERE nodename="All_Performance.Memory"  AND All_Performance.dest="hostname-11"

| tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap) AS swap FROM datamodel=COY_Performance  WHERE nodename="All_Performance.Memory"  AND All_Performance.dest="hostname-11"

This doesn’t work

| tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap_used) AS swap_used  FROM datamodel=COY_Performance  WHERE nodename="All_Performance.Memory"  AND All_Performance.dest="hostname-11"

But via the pivot on the datamodel, I do see metrics from "AllPerformance.Memory.swapused".

Any reason why my search returns nothing for

| tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap_used) AS swap_used  FROM datamodel=COY_Performance  WHERE nodename="All_Performance.Memory"  AND All_Performance.dest="hostname-11"
0 Karma
Highlighted

Re: Why are data model metrics not showing up with this search?

Contributor

Try using values() instead of avg(), to check what values are extracting.
Maybe that field configuration in the datamodel was supposed to be a number but was configured as a string?

0 Karma
Highlighted

Re: Why are data model metrics not showing up with this search?

Path Finder

Values() doesn't work and the field is configured as number

0 Karma
Highlighted

Re: Why are data model metrics not showing up with this search?

Contributor

What do you mean values doesn't work?
What result you get for:

| tstats xxxx_summaries_only values(AllPerformance.Memory.swapused) AS swapused FROM datamodel=COYPerformance WHERE nodename="AllPerformance.Memory" AND AllPerformance.dest="hostname-11"

0 Karma
Highlighted

Re: Why are data model metrics not showing up with this search?

Path Finder

correct.
tstats xxxxsummariesonly values(AllPerformance.Memory.swapused) AS swapused FROM datamodel=COYPerformance WHERE nodename="AllPerformance.Memory" AND AllPerformance.dest="hostname-11"

didn't work

0 Karma
Highlighted

Re: Why are data model metrics not showing up with this search?

Contributor

didn't work, but what do you get as a result?

0 Karma
Highlighted

Re: Why are data model metrics not showing up with this search?

Path Finder

"no results found"

0 Karma
Highlighted

Re: Why are data model metrics not showing up with this search?

Contributor

Try to view the table in the pivot, and click "open in search"
Then inspect the search details and look in search.log
You will find the |tstats that was running in the background

0 Karma