search

guilhemmarchand / nmon-for-splunk

NMON For Splunk App - convert, index and exploit nmon metrics data for AIX, Solaris and Linux Systems
23 stars 13 forks source link

NMON_Data_PAGE data model issue: Comparator '=' has an invalid term #106

Closed guilhemmarchand closed 6 years ago

guilhemmarchand commented 7 years ago

Splunk 7 generates an issue with the NMON_Data_PAGE data model, such as:

12-04-2017 17:51:15.180 INFO  SearchParser - PARSING: tstats  prestats=t local=f summariesonly=f allow_old_summaries=f chunk_size=10000000 max("PAGE_AIX.pgin") AS faults from datamodel=NMON_Data_PAGE where (nodename = PAGE_AIX)

12-04-2017 17:51:15.188 INFO  UserManager - Unwound user context: s66883 -> NULL

12-04-2017 17:51:15.189 ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Comparator '=' has an invalid term on the right hand side: pgin+pgsin

The root cause is the "()" block around the calculated fields, removing the parenthesis solves the issue.