Splunk Search

appendcols and streamstats with alltime

dataisbeautiful
Communicator

Hi all

I have a search that works for a range of a few days (eg earliest=-7d@d), but when running for alltime it breaks. I suspect this is an issue with appendcols or streamstats? Any pointers would be appreciated.

I'm using this to generate a lookup which I can then search instead of using an expensive alltime.

index=ndx sourcetype=src (device="PM4") earliest=0 latest=@d
| bucket _time span=1d
| stats max(value) as PM4Val by _time index
| appendcols 
[ search index=ndx sourcetype=src (device="PM2") earliest=0 latest=@d
| bucket _time span=1d
| stats max(value) as PM2Val by _time index
]
| streamstats current=f last(PM4Val) as LastPM4Val last(PM2Val) as LastPM2Val by index
| eval PM4ValDelta = PM4Val - LastPM4Val, PM2ValDelta = PM2Val - LastPM2Val
| table _time, index, PM4Val, PM4ValDelta, PM2Val, PM2ValDelta
| sort index -_time

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Subsearches are usually limited to 50k events so an alltime subsearch it likely to have been (silently) terminated. Given that your index and source type are the same, try removing the subsearch

index=ndx sourcetype=src (device="PM4" OR device="PM2") earliest=0 latest=@d
| bucket _time span=1d
| stats max(eval(if(device="PM4",value,null()))) as PM4Val max(eval(if(device="PM2",value,null()))) as PM2Val by _time index

 

View solution in original post

dataisbeautiful
Communicator

Doing an EVAL in STATS has made by day @ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Subsearches are usually limited to 50k events so an alltime subsearch it likely to have been (silently) terminated. Given that your index and source type are the same, try removing the subsearch

index=ndx sourcetype=src (device="PM4" OR device="PM2") earliest=0 latest=@d
| bucket _time span=1d
| stats max(eval(if(device="PM4",value,null()))) as PM4Val max(eval(if(device="PM2",value,null()))) as PM2Val by _time index

 

PickleRick
SplunkTrust
SplunkTrust

50k is the limit on subsearch when used with join command. The "normal" subsearch limit is much lower - it's 10k results.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Enterprise 9.4: Tools for Digital Resilience

What’s New in Splunk Enterprise 9.4: Tools for Digital ResilienceTune in to What’s New in Splunk Enterprise ...

Get Schooled with Splunk Education: Explore Our Latest Courses

At Splunk Education, we’re dedicated to providing incredible learning experiences that cater to every skill ...

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...