Splunk Search

appendcols and streamstats with alltime

dataisbeautiful
Communicator

Hi all

I have a search that works for a range of a few days (eg earliest=-7d@d), but when running for alltime it breaks. I suspect this is an issue with appendcols or streamstats? Any pointers would be appreciated.

I'm using this to generate a lookup which I can then search instead of using an expensive alltime.

index=ndx sourcetype=src (device="PM4") earliest=0 latest=@d
| bucket _time span=1d
| stats max(value) as PM4Val by _time index
| appendcols 
[ search index=ndx sourcetype=src (device="PM2") earliest=0 latest=@d
| bucket _time span=1d
| stats max(value) as PM2Val by _time index
]
| streamstats current=f last(PM4Val) as LastPM4Val last(PM2Val) as LastPM2Val by index
| eval PM4ValDelta = PM4Val - LastPM4Val, PM2ValDelta = PM2Val - LastPM2Val
| table _time, index, PM4Val, PM4ValDelta, PM2Val, PM2ValDelta
| sort index -_time

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Subsearches are usually limited to 50k events so an alltime subsearch it likely to have been (silently) terminated. Given that your index and source type are the same, try removing the subsearch

index=ndx sourcetype=src (device="PM4" OR device="PM2") earliest=0 latest=@d
| bucket _time span=1d
| stats max(eval(if(device="PM4",value,null()))) as PM4Val max(eval(if(device="PM2",value,null()))) as PM2Val by _time index

 

View solution in original post

dataisbeautiful
Communicator

Doing an EVAL in STATS has made by day @ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Subsearches are usually limited to 50k events so an alltime subsearch it likely to have been (silently) terminated. Given that your index and source type are the same, try removing the subsearch

index=ndx sourcetype=src (device="PM4" OR device="PM2") earliest=0 latest=@d
| bucket _time span=1d
| stats max(eval(if(device="PM4",value,null()))) as PM4Val max(eval(if(device="PM2",value,null()))) as PM2Val by _time index

 

PickleRick
SplunkTrust
SplunkTrust

50k is the limit on subsearch when used with join command. The "normal" subsearch limit is much lower - it's 10k results.

0 Karma
Get Updates on the Splunk Community!

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...

New Splunk Innovations Enhance Performance and Accelerate Troubleshooting

Splunk is excited to announce new releases that empower ITOps and engineering teams to stay ahead in ever ...