Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Data Model adding indexes

$
0
0
Hi at all, I have a search very simple (`tag=MYTAG`) that gives to me results that I use in a timechart count by a field (my_field) and correctly runs giving time distribution for the two values of my_field (OK, KO). tag=MYTAG | timechart count by my_field If I use it in a Data Model, I have as result of the related Pivot three values (OK, KO, NULL) instead the correct two values. Exploding results as search, I see that Data Model added to my search (`tag=MYTAG`) the additional condition `(index=* OR index=_*)` that gives the problem of the NULL values. Why this appens? I was wrong in Data Model Configuration? Is there a way to avoid this? Thank you in advance. Bye. Giuseppe

Viewing all articles
Browse latest Browse all 47296

Trending Articles