- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
deodion
Path Finder
03-12-2019
04:03 AM
I try to use mstats and mcatalog command
it just simply does not work, I think its Splunk settings side Im missing,
such as this:
| mstats sum(bytes) latest(_time) where index=metrics_app_dest_survey by app_name
Im using admin account, is there anything wrong with user role capability?
I only see one thing relevant list_metrics_catalog
is added capability, but still not working,
What am I missing? thanks!
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
deodion
Path Finder
03-27-2019
07:21 PM
Hello thaggie,
thanks for replying, the problem with this is simply that I didnt setup the index type correctly, the index type should be metric.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
deodion
Path Finder
03-27-2019
07:21 PM
Hello thaggie,
thanks for replying, the problem with this is simply that I didnt setup the index type correctly, the index type should be metric.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![thaggie_splunk thaggie_splunk](https://community.splunk.com/legacyfs/online/avatars/456226.jpg)
thaggie_splunk
![Splunk Employee Splunk Employee](/html/@F88B7774A2BF2E9108D79A067A92A581/rank_icons/employee-16.png)
Splunk Employee
03-27-2019
12:25 PM
When you execute:
| mcatalog values(metric_name) where index=metrics_app_dest_survey
Do you get any values back?
You can't aggregate time so you need to remove latest(_time), this should work:
| mstats sum(bytes) where index=metrics_app_dest_survey by app_name
![](/skins/images/5D2DD17C284106BFBF80528D01D8AA1A/responsive_peak/images/icon_anonymous_message.png)