https://community.splunk.com/t5/Getting-Data-In/No-results-in-search/m-p/345316#M63458 <P>So did it solve your problem already?</P> Tue, 13 Jun 2017 20:51:04 GMT MuS 2017-06-13T20:51:04Z https://community.splunk.com/t5/Getting-Data-In/No-results-in-search/m-p/345312#M63454 <P>deleted</P> Tue, 13 Jun 2017 20:35:43 GMT https://community.splunk.com/t5/Getting-Data-In/No-results-in-search/m-p/345312#M63454 patilsh 2017-06-13T20:35:43Z https://community.splunk.com/t5/Getting-Data-In/No-results-in-search/m-p/345313#M63455 <P>Quick check, do you have the fields <CODE>eventData.farTalk</CODE> and <CODE>callid</CODE> available? Also check the names of the fields since they are case sensitive.</P> <P>cheers, MuS</P> Tue, 13 Jun 2017 20:46:06 GMT https://community.splunk.com/t5/Getting-Data-In/No-results-in-search/m-p/345313#M63455 MuS 2017-06-13T20:46:06Z https://community.splunk.com/t5/Getting-Data-In/No-results-in-search/m-p/345314#M63456 <P>your query looks correct, try giving space between |and stats command , also make sure the eventData.farTalk and callid are showing up in the interesting fileds when you look at raw events and that their spelling is correct.</P> Tue, 13 Jun 2017 20:48:28 GMT https://community.splunk.com/t5/Getting-Data-In/No-results-in-search/m-p/345314#M63456 newbie2tech 2017-06-13T20:48:28Z https://community.splunk.com/t5/Getting-Data-In/No-results-in-search/m-p/345315#M63457 <P>Thanks, that helped!!!</P> Tue, 13 Jun 2017 20:49:42 GMT https://community.splunk.com/t5/Getting-Data-In/No-results-in-search/m-p/345315#M63457 patilsh 2017-06-13T20:49:42Z https://community.splunk.com/t5/Getting-Data-In/No-results-in-search/m-p/345316#M63458 <P>So did it solve your problem already?</P> Tue, 13 Jun 2017 20:51:04 GMT https://community.splunk.com/t5/Getting-Data-In/No-results-in-search/m-p/345316#M63458 MuS 2017-06-13T20:51:04Z