Splunk Search

fields - values search command breaks dashboard when edit mode was activated

mhornste
Path Finder

Hi,

I'm running Splunk 6.4.0 with two customers.

When using the fields - values search command, the dashboard is not showing any data after I have clicked on Edit --> Panels. The spaces are automatically removed from fields - values --> fields-values resulting in the dashboard not showing any data any more (I can't attach a screenshot due to missing karma points). This is really annoying.

Maybe external links are allowed: http://imgur.com/a/4tGWt

I'm using the following search string:

index=otcs eventtype="SummaryTiming" | stats count values(FunctionAction), avg(ExecutionTime) by ContextUserName| fields - values(FunctionAction) | $user_avgexecution_sort$ | Rename ContextUserName as "Requesting User" | Rename count as "Number of Requests" | Rename avg(ExecutionTime) as "Average Execution Time"

Is this a bug of Splunk 6.4.x?

0 Karma
1 Solution

lguinn2
Legend

No bug, but you are doing a few things that violate Splunk syntax and make your search run more slowly. Try this

index=otcs eventtype="SummaryTiming" 
| stats count avg(ExecutionTime) as avgTime by ContextUserName
| $user_avgexecution_sort$ 
| Rename ContextUserName as "Requesting User" 
| Rename count as "Number of Requests" | Rename avgTime as "Average Execution Time"

Sometimes Splunk does not like field names that have punctuation in them, some commands don't care. Therefore, I always use the "as" in stats to give those fields better (and easier to read) names. I created a field called avgTime in line 2 and used it in the final line.
Also, you created "values(FunctionAction)" in the stats command and then you never used it; you simply removed that result immediately afterward. I solved the problem by simply removing the initial calculation in the stats command.

View solution in original post

mhornste
Path Finder

Thanks, it worked!

0 Karma

lguinn2
Legend

No bug, but you are doing a few things that violate Splunk syntax and make your search run more slowly. Try this

index=otcs eventtype="SummaryTiming" 
| stats count avg(ExecutionTime) as avgTime by ContextUserName
| $user_avgexecution_sort$ 
| Rename ContextUserName as "Requesting User" 
| Rename count as "Number of Requests" | Rename avgTime as "Average Execution Time"

Sometimes Splunk does not like field names that have punctuation in them, some commands don't care. Therefore, I always use the "as" in stats to give those fields better (and easier to read) names. I created a field called avgTime in line 2 and used it in the final line.
Also, you created "values(FunctionAction)" in the stats command and then you never used it; you simply removed that result immediately afterward. I solved the problem by simply removing the initial calculation in the stats command.

dbcase
Motivator

Also if you are going to use the above query in a dashboard make sure you add a preceeding $ and trailing $ to the user_avgexecution_sort

example

$$user_avgexecution_sort$$
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...