Splunk Search

License Percentage Used Saved Search returning odd values

wwhitener
Communicator

Greetings,

I have a saved search:

index=_internal sourcetype=splunkd Metrics "group=per_host_thruput" | stats sum(kb) AS Totalkb | Eval GB=round(Totalkb/1048576,2) | eval percent=round(GB/.5 * 100) | TABLE percent

This is tied to the custom time range -24h@d -- to hopefully snap it so that I get the past 24 hours up to 000 hours this morning.

I saved this little query and tried to run it from the command line. I was expecting a single value, but instead got:


Preview of: | savedsearch Percent_Used

percent

------

74

Preview of: | savedsearch Percent_Used

percent

-------

84

percent

-------

2148

I've never seen the previews before upgrading to 4.2.2. I really only need the last value--not the "previews". Is there a way to turn this off with 4.2.2?

Thank you!

0 Karma
1 Solution

wwhitener
Communicator

http://splunk-base.splunk.com/answers/8288/where-is-the-option-to-disable-preview-at-cant-find-it-an... has some good information on this. I ended up going to the search and clicking on the results and found this checkbox.

View solution in original post

0 Karma

wwhitener
Communicator

http://splunk-base.splunk.com/answers/8288/where-is-the-option-to-disable-preview-at-cant-find-it-an... has some good information on this. I ended up going to the search and clicking on the results and found this checkbox.

0 Karma

wwhitener
Communicator

This more or less answered my question--how to get rid of the Preview. I'm marking it as answered.

0 Karma
Get Updates on the Splunk Community!

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...