Splunk Search

splunk trending...

DTERM
Contributor

I'm trying to integrate information from this link http://splunk-base.splunk.com/answers/13482/plotting-trendlines-into-the-future into my search and am having a few issues.

I've created the lineartrend(2) and extrendtrend(2) as suggested by the link above. Now I'd like to pass those macros into a search utilizing an index, not syslog. That being said, when I run the following query

index=myapp |timechart count
| lineartrend(_time, count)
| extendtrend(newY, 7)
| eval low_threshold=5000
| eval high_threshold=50000
| timechart values(count) as events values(newY) as linear_trend values(low_threshold) as low_threshold values(high_threshold) as high_threshold

The error I get is a the following:

Search operation 'args; is unknown. You might not have permission to run this operation.

Now I'm running this as admin, so the latter part of the error is not accurate at all.

Why is the search complaining about 'args'? What am I missing?

TIA

Tags (1)
0 Karma
1 Solution

Paolo_Prigione
Builder

You have to invoke macros enclosed in backtics `.

index=myapp |timechart count 
  | `lineartrend(_time, count)`
  | `extendtrend(newY, 7)`
  | eval low_threshold=5000 
  | eval high_threshold=50000 
  | timechart values(count) as events values(newY) as linear_trend values(low_threshold) as     low_threshold values(high_threshold) as high_threshold

View solution in original post

0 Karma

Paolo_Prigione
Builder

You have to invoke macros enclosed in backtics `.

index=myapp |timechart count 
  | `lineartrend(_time, count)`
  | `extendtrend(newY, 7)`
  | eval low_threshold=5000 
  | eval high_threshold=50000 
  | timechart values(count) as events values(newY) as linear_trend values(low_threshold) as     low_threshold values(high_threshold) as high_threshold
0 Karma

DTERM
Contributor

The macros were copied and pasted directly from the link. Unless there is a typo in the posted macros, I don't think that is true.

What is a good test to see if the macros work stand alone? My test is just piping the entire index into the macro. Is there a better test?

0 Karma

lguinn2
Legend

My guess is that you have a typo in your macros.conf file, but there is no way to tell from here...

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...