Splunk Search

timechart function issue

prathapkcsc
Explorer

Hi everyone,
my query look like this
base search | reg " " | | bin _time as desired_times span=4h
| table _time server CPU MEM DISK raw1 raw2

This query working perfectly, giving desired results.
But after adding "| timechart max(DISK) as DISK by server" , its giving me all servers except two servers, meanwhile it was giving me the new column named as "OTHERS" which is not existed in my data.
Can anyone explain about this?

0 Karma

dineshraj9
Builder

You need to use the limit attribute and all the servers would be listed -
http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Timechart

| timechart limit=0 max(DISK) as DISK by server
0 Karma

prathapkcsc
Explorer

base search | reg " " | | bin _time as desired_times span=4h | | where _time = desired_times
| table _time server CPU MEM DISK raw1 raw2.

In where_time=desired_times,
my desired timings are 8AM,12PM,18PM.
How to give all 3 timings in that where clause

0 Karma

dineshraj9
Builder

If you are wanting to search for events only during these hours, then use the date_hour field before the table command.

| search date_hour=8 OR date_hour=12 OR date_hour=18

To get events during these hours.

0 Karma

prathapkcsc
Explorer

Awesome mate..
Thank you somuch..worked perfectly

0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...