|
This is the reference that I'm looking at: http://www.splunk.com/wiki/Community:TroubleshootingIndexedDataVolume Specifically this search:
And I get this error:
Relating to this part of the search:
So, I look up the search manual and there is in fact no sum function to the where command. I've tried a bunch of variations and I'm not getting the expected result. Can anyone shed any light on where I'm going wrong (and fix the doco) Thanks. |
|
The correct syntax is either: index=_internal source=license_usage pool="default" | eval GB=b/1024/1024/1024 | stats sum(GB) by pool | where 'sum(GB)' > 0.3 i.e., single quote index=_internal source=license_usage pool="default" | eval GB=b/1024/1024/1024 | stats sum(GB) as sumGB by pool | where sumGB > 0.3 |
