Splunk Search

mstats produces 2 buckets when span and time picker are both equal

emc2family
New Member

hi i ran a search to calculate 95th percentile in a 7 day span and output in a single bucket the result:

| mstats p95(_value) as p95 WHERE metric_name="Network_Interface.Bytes_Received/sec" AND "index"="win_em_metrics" span=7d

i had my time picker set to 7 days ago. however i'm getting two result buckets:

_time p95
2019-05-07 92721.795365
2019-05-14 109483.252954

i tried to use _time >= strptime("2018-05-08 00:00:00", "%Y-%m-%d %H:%M:%S") AND _time <= strptime("2018-05-14 23:59:59", "%Y-%m-%d %H:%M:%S") instead of span=7d, but i get a "term based search is not supported" message

appreciate very much for any help. thnx

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...