Cannot get results from query using subsearch. I would like to compare the previous percentage of used space with the current percentage of used space. My subsearch looks at the current percentage of usage and should run first. That should be returning 51 (I'm converting the percentage into a numeric number in each query) which right now matches the previous percentage of space used so I am expecting results but getting none. There is only 1 result every 15 minutes.
earliest=-30m latest=-15m index=123456 sourcetype=abcdefg filer=higklmn name="opqrstuv"
| convert num(usedPercent) as pastPercent
| SEARCH pastPercent=currentPercent
[ SEARCH earliest=-15m latest=now index=123456 sourcetype=abcdefg filer=higklmn name="opqrstuv"
|convert num(usedPercent) as currentPercent
| table currentPercent | return currentPercent ]
Any help would be appreciated!
↧
