search string

[Splunk_U]

Is there any thing wrong with the below search string?????

index=os source=df |multikv fields Filesystem Avail UsePct | search Filesystem=/dev/mapper/system-root | eval availPct=(100-UsePct) | stats avg(Avail) as availDisk avg(availPct) as UsePct by host

[yannK]

Verify is UsePct is a string or a number.
use | convert num(UsePct) if needed

[Ayn]

What format are the values for Avail in? If avg() doesn't return anything even though Avail has values, it indicates that the Avail values aren't something that avg() can treat as numbers.

[Splunk_U]

Till the below portion it is working fine..

index=os source=df |multikv fields Filesystem Avail UsePct | search Filesystem=/dev/mapper/system-root

then when I am adding "stats avg(Avail) as availDisk by host" it is not fetching any data...where as if I add "stats values(Avail) as availDisk by host" then the data is coming...

Any thought!!!

[sdaniels]

It usually makes sense to break down your search and track when you are getting data and then where you aren't getting what you expect. Start with the beginning and then add additional commands one by one to see where the search is breaking down.

[Splunk_U]

I am getting no result...but it should provide me the avg available disk info and and avg available percentage..Am I missing something in syntax???

[Ayn]

I assume there's a reason for asking? What results are you currently getting?