Splunk Search

Why is my stats command with timechart producing null values for a field?

brian38401
New Member

My stats command is working, but when I pump it into timechart, it shows null values for fraction:

index=ide | stats count(eval(msgId=15)) as TIMEOUT,  count(eval(msgId=12)) as REQUEST, max(_time) as _time | eval fraction = TIMEOUT/REQUEST*100 | timechart max(fraction)

Any idea what I am missing here?

Thanks

0 Karma

jkat54
SplunkTrust
SplunkTrust

You'll need a "by-clause" in the stats or timechart command. BY _time not AS _time. One creates a column, the other creates a row.. Timechart is looking for columns by rows of time.

Try these:

index=ide | stats count(eval(msgId=15)) as TIMEOUT, count(eval(msgId=12)) as REQUEST, max(_time) as _time |  eval fraction = TIMEOUT/REQUEST*100 | timechart max(fraction) by _time

index=ide | stats count(eval(msgId=15)) as TIMEOUT, count(eval(msgId=12)) as REQUEST, max(_time) as maxtime by _time |  eval fraction = TIMEOUT/REQUEST*100 | timechart max(fraction) 

index=ide | stats count(eval(msgId=15)) as TIMEOUT, count(eval(msgId=12)) as REQUEST by _time |  eval fraction = TIMEOUT/REQUEST*100 | timechart max(fraction) max(_time) 

Wait, why are we getting max(_time)? Anytime you manipulate _time you cause problems. Problems that can be fixed but i'm just trying to understand why you need the maximum thereof.

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...