Splunk Search

debugging when columns are not filled out

tb5821
Communicator

How does one debug searches when you expect a column to be filled out yet its not?

sourcetype=mongo_stats 
| streamstats current=f last(count) as last_count last(_time) as time_of_last_change by namespace
| eval diffoflastchange=now()-time_of_last_change
| eval HH:MM:SS_since_last_change=tostring(diffoflastchange,"duration")
| rename count as current_count 
| fieldformat current_count=tostring(current_count,"commas") 
| table namespace current_count  HH:MM:SS_since_last_change lastChange | addcoltotals current_count | dedup namespace  | sort -current_count

for some reason the only columns I get are namespace and current count - the others are all blank but the logic to calculate the others looks right!

0 Karma

kmaron
Motivator

In my experience it's best to strip down to the first piece and make sure it works then add back a piece at a time. so start with your streamstats and make sure its giving you what you expect.

 sourcetype=mongo_stats 
 | streamstats current=f last(count) as last_count last(_time) as time_of_last_change by namespace

is count a field that already exists in your sourcetype? if not you'll need a stats to do your counting before the streamstats.

0 Karma

tb5821
Communicator

yes it exists - problem seems to be that it can't tie the eval fields to the right namespace field?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...