Queries not giving exact result

sunnyparmar — Tue, 29 Sep 2020 07:18:57 GMT

Hi,

My queries is something like given below -

index=abc sourcetype=xyz ERROR | rename ERROR as "Error message" | timechart span=1h count by "Error message"

but it is not giving the exact result when its running. I want to see the column "error message" with the time frame but it's giving me the column "null" with the time frame. Any suggestions would be appreciated. Thanks

In the 2nd query -

index=abc sourcetype=xyz upload_log_message="ERROR*" | rename upload_log_message as "Error message" | top "Error message"

Through this query i want to see the top error messages that is showing in 1st query. this query is returning "no result found". How it could be possible when from 1st query i am able to fetching the error logs. Any ideas for this?

Thanks

Re: Queries not giving exact result

woodcock — Sun, 20 Sep 2015 14:29:38 GMT

Although you are selecting events with the string "error", you are not creating a field called ERROR so splunk is using null to indicate this. You need to use the rex command (before the stats command) to create this field and then it will work.

topic Re: Queries not giving exact result in Getting Data In

Queries not giving exact result

Re: Queries not giving exact result