Splunk Search

last(count) pick older value. Is there any way to block thi behaviour?

New Member

Deal Splunkers,

I'm doing a serach like this to valorize a SingleValue indicator with range:

<my search> | eval secondsElapsedToday = now()-relative_time(now(), "@d") | eval _time=_time-secondsElapsedToday | bucket _time span=1d | stats count by _time | stats last(count) as today_count avg(count) as avg_count | eval range = case(today_count<avg_count, "low", today_count=avg_count, "elevated", today_count>=avg_count, "severe")

The problem is that if in the last day there aren't events the indicator show the last picked value. Is there any way to say that if in the last day value is absent the search have not to pick the earlier value?

thank you

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

Probably you need to insert ... stats count by _time | eval count=coalesce(count,0) | stats last(count) as today_count ...

0 Karma