Splunk Search

License Percentage Used Saved Search returning odd values

wwhitener
Communicator

Greetings,

I have a saved search:

index=_internal sourcetype=splunkd Metrics "group=per_host_thruput" | stats sum(kb) AS Totalkb | Eval GB=round(Totalkb/1048576,2) | eval percent=round(GB/.5 * 100) | TABLE percent

This is tied to the custom time range -24h@d -- to hopefully snap it so that I get the past 24 hours up to 000 hours this morning.

I saved this little query and tried to run it from the command line. I was expecting a single value, but instead got:


Preview of: | savedsearch Percent_Used

percent

------

74

Preview of: | savedsearch Percent_Used

percent

-------

84

percent

-------

2148

I've never seen the previews before upgrading to 4.2.2. I really only need the last value--not the "previews". Is there a way to turn this off with 4.2.2?

Thank you!

0 Karma
1 Solution

wwhitener
Communicator

http://splunk-base.splunk.com/answers/8288/where-is-the-option-to-disable-preview-at-cant-find-it-an... has some good information on this. I ended up going to the search and clicking on the results and found this checkbox.

View solution in original post

0 Karma

wwhitener
Communicator

http://splunk-base.splunk.com/answers/8288/where-is-the-option-to-disable-preview-at-cant-find-it-an... has some good information on this. I ended up going to the search and clicking on the results and found this checkbox.

0 Karma

wwhitener
Communicator

This more or less answered my question--how to get rid of the Preview. I'm marking it as answered.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...