Splunk Search

timechart function issue

prathapkcsc
Explorer

Hi everyone,
my query look like this
base search | reg " " | | bin _time as desired_times span=4h
| table _time server CPU MEM DISK raw1 raw2

This query working perfectly, giving desired results.
But after adding "| timechart max(DISK) as DISK by server" , its giving me all servers except two servers, meanwhile it was giving me the new column named as "OTHERS" which is not existed in my data.
Can anyone explain about this?

0 Karma

dineshraj9
Builder

You need to use the limit attribute and all the servers would be listed -
http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Timechart

| timechart limit=0 max(DISK) as DISK by server
0 Karma

prathapkcsc
Explorer

base search | reg " " | | bin _time as desired_times span=4h | | where _time = desired_times
| table _time server CPU MEM DISK raw1 raw2.

In where_time=desired_times,
my desired timings are 8AM,12PM,18PM.
How to give all 3 timings in that where clause

0 Karma

dineshraj9
Builder

If you are wanting to search for events only during these hours, then use the date_hour field before the table command.

| search date_hour=8 OR date_hour=12 OR date_hour=18

To get events during these hours.

0 Karma

prathapkcsc
Explorer

Awesome mate..
Thank you somuch..worked perfectly

0 Karma