Splunk Search

Why is my stats command with timechart producing null values for a field?

New Member

My stats command is working, but when I pump it into timechart, it shows null values for fraction:

index=ide | stats count(eval(msgId=15)) as TIMEOUT,  count(eval(msgId=12)) as REQUEST, max(_time) as _time | eval fraction = TIMEOUT/REQUEST*100 | timechart max(fraction)

Any idea what I am missing here?

Thanks

0 Karma

SplunkTrust
SplunkTrust

You'll need a "by-clause" in the stats or timechart command. BY _time not AS _time. One creates a column, the other creates a row.. Timechart is looking for columns by rows of time.

Try these:

index=ide | stats count(eval(msgId=15)) as TIMEOUT, count(eval(msgId=12)) as REQUEST, max(_time) as _time |  eval fraction = TIMEOUT/REQUEST*100 | timechart max(fraction) by _time

index=ide | stats count(eval(msgId=15)) as TIMEOUT, count(eval(msgId=12)) as REQUEST, max(_time) as maxtime by _time |  eval fraction = TIMEOUT/REQUEST*100 | timechart max(fraction) 

index=ide | stats count(eval(msgId=15)) as TIMEOUT, count(eval(msgId=12)) as REQUEST by _time |  eval fraction = TIMEOUT/REQUEST*100 | timechart max(fraction) max(_time) 

Wait, why are we getting max(_time)? Anytime you manipulate _time you cause problems. Problems that can be fixed but i'm just trying to understand why you need the maximum thereof.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!