I am new to splunk and I do not understand why this is giving me the same result.
There are 3 different site_names I am looking to to get the max latency out of all three.
Then when a user chooses a filter just to get the max for what they chose
index=fultonrssi sourcetype=FultonRSSI test_type_code=PING site_name="Bear Creek MS" closet_id="*" host=*| timechart max(latency) as "Max Latency"
index=fultonrssi sourcetype=FultonRSSI test_type_code=PING site_name="Banneker HS" closet_id="*" host=*| timechart max(latency) as "Max Latency"
This is the result for both
_time Max Latency
2019-10-01 14:30:00 2055.8
I looked at the raw data and they are definitely different
thanks
↧