topic Re: Issue with "Create Table View" in Splunk Enterprise

Issue with "Create Table View"

bipul — Thu, 26 Sep 2024 10:52:55 GMT

I've written a Splunk Query and ran it, it's giving the result as expected but as soon as I click on "Create Table View" some of the field disappears which were earlier coming post the query run. Not sure what is wrong, could anyone help?

Re: Issue with "Create Table View"

ITWhisperer — Thu, 26 Sep 2024 11:15:49 GMT

Can you be a bit more specific? Which fields have "disappeared"? What does your SPL look like?

Re: Issue with "Create Table View"

bipul — Thu, 26 Sep 2024 18:17:27 GMT

index="aws" earliest=-7d@d latest=@d | search "Method request" "systemId" | rex field=_raw "\((?<messageId>[^)]+)\)[^:]+:\s*\{(?<messageFields>.*)\}" | rex field=messageFields "Id=(?<systemId>[^,]+)" | rex field=messageFields "product=(?<product>[^,]+(?:,[^,]+)*)(?=, systemId=)" | rex field=_raw "Field=\"(?<eventFieldName>[^\"]+)\"" | rex field=_raw "FieldValue=\"(?<eventFieldValue>[^\"]+)\"" | rex field=_raw "type=\"(?<eventType>[^\"]+)\"" | search product="O,U" systemId!="0454c7f5" | dedup messageId | join type=left messageId [ | from datamodel:"getStatusCodes" | fields messageId, statusCode ] | join type=left systemId [ | from datamodel:"verifyCalls" | rename siteCoreId as systemId | eval Verified="Yes" | fields systemId, Verified ] | eval Verified=coalesce(Verified, "No") | table _time, messageId, systemId, statusCode, Verified | sort - _time | head 10000

Above is the Splunk Query. When I search this query I get these fields in the output (_time, messageId, systemId, statusCode, Verified) but when I click on "Create Table View" only (_time, messageId, statusCode) fields are coming.

Re: Issue with "Create Table View"

ITWhisperer — Thu, 26 Sep 2024 14:41:15 GMT

Since you are using joins, you could be hitting limits on the subsearches - have you tried a shorter timeframe?

Re: Issue with "Create Table View"

bipul — Fri, 27 Sep 2024 06:56:04 GMT

Yes, I tried fetching for only 1 day instead of 7 days but still the same issue. After clicking on "Create Table View" those fields are disappearing.

Re: Issue with "Create Table View"

ITWhisperer — Fri, 27 Sep 2024 07:33:34 GMT

Why not use your search in a dashboard panel table?

Re: Issue with "Create Table View"

bipul — Fri, 27 Sep 2024 10:01:02 GMT

I'm not sure how to do that. Let me figure this out how to search in dashboard panel. I'm new to Splunk still learning.