I'm using mstats earliest_time(metric) to find the earliest time for metric. If I use |mstats prestats=false earliest_time("http_req_duration_value") as "Start Time" where index=a...
...ther query | mstats prestats=true avg(load.*) WHERE (`sai_metrics_indexes`) AND host=lalalala by host span=1m | timechart span=1m avg(load.longterm) AS Longterm by host which also works perfectly N...
Is there a way to use the improved mstats syntax introduced in 7.1 (changes described here) with metrics that have spaces in their names? I'm getting an error "Term based search is not supported" w...
I am not able to get the latest (or earliest) _time values using mstats.
| mstats sum(bytes) latest(_time)
where index=metrics_app_dest_survey by app_name
is returning:
@sideview Hi Nick I am using a join with mstat, but i am hoping that i dont have to. However, i cant crack it - any help would be amazing. Below is the current SPL | mstats min("m...
I try to use mstats and mcatalog command
it just simply does not work, I think its Splunk settings side Im missing,
such as this:
| mstats sum(bytes) latest(_time) where index=m...
...o be specific to some hosts. 1)
| mstats max(cpu.idle) AS "CPU_IDLE" avg(memory.free) as "MEMORY_FREE" avg(swap.used) as "SWAP_USED" WHERE `sai_metrics_indexes` earliest=-30m@m by host | eval "c...
I know that events and metrics use different index types. Does that mean I can't create an alert (outside of metrics workspace) using an SPL search with mstats?
E.g., I am pumping collectd uptime i...
How to convert `_time` to the column and `host` as an index while using `mstats`? | mstats avg(_value) prestats=true WHERE metric_name="cpu.*" AND index="*" AND (host="host01.example...
...oin works one of the fields - "Uptime_seconds" - in the initial search generates becomes empty. My initial query is: | mstats latest(System.System_Up_Time) as Uptime_seconds latest(Processor.%_...