About tborup

tborup · ‎11-11-2015

If I change the query part to this <search base="BaseSearch"> <query>fields _time count timing</query> </search> the value timing disappears. This is unexpected, but it gives me the result I want and I am able to show the count value in a gauge. In case the basesearch is important in giving the answer to this unexpected behavior, I'll provide it here. `FMK_servers_auditLog` | fields _time processingTime | bin _time span=2s as sek2 | eval sek=strftime(sek2,"%H:%M:%S") | stats count avg(processingTime) as timing by sek | eval count = count*0.5 | eval timing = timing/10

tborup · ‎11-10-2015

I have a dashboard referring a saved search. The search is a real-time search returning the values timing and count by _time. The dashboard works fine until I change "where timing < 10" to "fields timing" or "timechart avg(timing)". After this change, no values are shown in the graph. Can this be explained in any way? The goal is to use one real-time search on both a graph with two values (timing and count) and a gauge only showing the value of count. <dashboard> <search id="BaseSearch" ref="Request pr.min RT"></search> <row> <panel> <chart> <search base="BaseSearch"> <query>where timing < 10</query> </search> ..... Splunk version: 6.2.3

Posts	2
Solutions	1
Karma Given	0
Karma Received	1
Member Since	‎12-15-2014

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Why is my post process real-time base saved search...

Re: Why is my post process real-time base saved se...

Why is my post process real-time base saved search...