In going through the SplunkCloud SPL tutorial, we are told to upload California drought data into Splunk, and we create a Dashboard from it. That worked just as explained, but the next day the data is gone. I was using the "AllTime" filter, so it was not that I missed data that was getting older, and skipped by filters.
source="us_drought_monitor.csv" State = CA date_year=2018| rex field=County "(?<County>.+) County"| eval droughtscore = D1 + D2*2 + D3*3 + D4*4| stats avg(droughtscore) as "2018 Drought Score" by County| geom ca_county_lookup featureIdField=County
above is the search SPL for the demo.
While I have your attention, in the tutorial they add a min and max function, ""2018 Drought Score" max(droughtscore) as "Max 2018 Drought Score" min(droughtscore) as "Min 2018 Drought Score" by County" This provided SPL code broke the Dashboard yesterday when it was working. is there something wrong with this SPL, that was provided?
... View more