https://community.splunk.com/t5/Splunk-ITSI/Can-you-help-me-with-the-following-search-in-Splunk-IT-Service/m-p/459329#M1609 <P>Yes data is present in both the indexes when i am putting the time range for last 24 hr , the query showing data for some hour only.</P> <P>2018-11-05 13:00<BR /><BR /> 2018-11-05 14:00<BR /><BR /> 2018-11-05 15:00<BR /><BR /> 2018-11-05 16:00<BR /><BR /> 2018-11-05 17:00<BR /><BR /> 2018-11-05 18:00<BR /><BR /> 2018-11-05 19:00 3.434729064039409<BR /> 2018-11-05 20:00 3.149888143176734<BR /> 2018-11-05 21:00 3.30684500393391<BR /> 2018-11-05 22:00 4.191972076788831<BR /> 2018-11-05 23:00 3.518193224592221<BR /> 2018-11-06 00:00 3.2700892857142856<BR /> 2018-11-06 01:00 1.8670694864048338<BR /> 2018-11-06 02:00 2.3823529411764706<BR /> 2018-11-06 03:00 0.8616600790513834<BR /> 2018-11-06 04:00 0.7120786516853933<BR /> 2018-11-06 05:00 0.6442786069651741</P> <P>And when i am putting the time range in which data was not coming then its showing if i only keep that time range.<BR /> 2018-11-05 13:00 2.495167286245353<BR /> 2018-11-05 14:00 2.5229508196721313<BR /> 2018-11-05 15:00 2.86278964107224<BR /> 2018-11-05 16:00 2.9426594167078597<BR /> 2018-11-05 17:00 3.098828323993887<BR /> 2018-11-05 18:00 7.166666666666667</P> Tue, 06 Nov 2018 06:58:11 GMT Hemant1 2018-11-06T06:58:11Z https://community.splunk.com/t5/Splunk-ITSI/Can-you-help-me-with-the-following-search-in-Splunk-IT-Service/m-p/459326#M1606 <P>Hi team, could you please help me in the below query . </P> <P>When i am running the following search, it is not giving any data if i increase the time range to more than 8 hours. It's only giving 8 hours after that blank .</P> <P>(index=hybecmprod OR index=hybadmprod) "CLUB REGISTRATION END"<BR /> | rename UserID_End as UserID | sort by HYB_CLUB_END desc<BR /> | join UserID [search index=hybecmprod "Club registration START" | rename userID_Start as UserID | sort by Hybris_Club_Start desc ]<BR /> |dedup UserID <BR /> | eval et=strptime(HYB_CLUB_END,"%Y/%m/%d %H:%M:%S") | eval st=strptime(Hybris_Club_Start,"%Y/%m/%d %H:%M:%S") | eval diff = abs(et-st)<BR /> | timechart span=1h avg(diff)</P> Tue, 29 Sep 2020 21:53:34 GMT https://community.splunk.com/t5/Splunk-ITSI/Can-you-help-me-with-the-following-search-in-Splunk-IT-Service/m-p/459326#M1606 Hemant1 2020-09-29T21:53:34Z https://community.splunk.com/t5/Splunk-ITSI/Can-you-help-me-with-the-following-search-in-Splunk-IT-Service/m-p/459327#M1607 <P>this is how i am getting data when i am running query for 10 hr.<BR /> 2018-11-05 02:00<BR /><BR /> 2018-11-05 03:00<BR /><BR /> 2018-11-05 04:00<BR /><BR /> 2018-11-05 05:00<BR /><BR /> 2018-11-05 06:00 1.291497975708502<BR /> 2018-11-05 07:00 1.0997008973080757<BR /> 2018-11-05 08:00 1.2740183792815372<BR /> 2018-11-05 09:00 1.790200138026225<BR /> 2018-11-05 10:00 2.1325678496868474<BR /> 2018-11-05 11:00 2.3029525032092426<BR /> 2018-11-05 12:00 2.6684131736526946</P> Mon, 05 Nov 2018 11:34:43 GMT https://community.splunk.com/t5/Splunk-ITSI/Can-you-help-me-with-the-following-search-in-Splunk-IT-Service/m-p/459327#M1607 Hemant1 2018-11-05T11:34:43Z https://community.splunk.com/t5/Splunk-ITSI/Can-you-help-me-with-the-following-search-in-Splunk-IT-Service/m-p/459328#M1608 <P>Are you sure the data is present in both indexes for all 10 hours?</P> Mon, 05 Nov 2018 12:08:18 GMT https://community.splunk.com/t5/Splunk-ITSI/Can-you-help-me-with-the-following-search-in-Splunk-IT-Service/m-p/459328#M1608 richgalloway 2018-11-05T12:08:18Z https://community.splunk.com/t5/Splunk-ITSI/Can-you-help-me-with-the-following-search-in-Splunk-IT-Service/m-p/459329#M1609 <P>Yes data is present in both the indexes when i am putting the time range for last 24 hr , the query showing data for some hour only.</P> <P>2018-11-05 13:00<BR /><BR /> 2018-11-05 14:00<BR /><BR /> 2018-11-05 15:00<BR /><BR /> 2018-11-05 16:00<BR /><BR /> 2018-11-05 17:00<BR /><BR /> 2018-11-05 18:00<BR /><BR /> 2018-11-05 19:00 3.434729064039409<BR /> 2018-11-05 20:00 3.149888143176734<BR /> 2018-11-05 21:00 3.30684500393391<BR /> 2018-11-05 22:00 4.191972076788831<BR /> 2018-11-05 23:00 3.518193224592221<BR /> 2018-11-06 00:00 3.2700892857142856<BR /> 2018-11-06 01:00 1.8670694864048338<BR /> 2018-11-06 02:00 2.3823529411764706<BR /> 2018-11-06 03:00 0.8616600790513834<BR /> 2018-11-06 04:00 0.7120786516853933<BR /> 2018-11-06 05:00 0.6442786069651741</P> <P>And when i am putting the time range in which data was not coming then its showing if i only keep that time range.<BR /> 2018-11-05 13:00 2.495167286245353<BR /> 2018-11-05 14:00 2.5229508196721313<BR /> 2018-11-05 15:00 2.86278964107224<BR /> 2018-11-05 16:00 2.9426594167078597<BR /> 2018-11-05 17:00 3.098828323993887<BR /> 2018-11-05 18:00 7.166666666666667</P> Tue, 06 Nov 2018 06:58:11 GMT https://community.splunk.com/t5/Splunk-ITSI/Can-you-help-me-with-the-following-search-in-Splunk-IT-Service/m-p/459329#M1609 Hemant1 2018-11-06T06:58:11Z https://community.splunk.com/t5/Splunk-ITSI/Can-you-help-me-with-the-following-search-in-Splunk-IT-Service/m-p/459330#M1610 <P>Hi, @Hemant1 maybe you hit the limit of max of 50K records returned by subsearch, we can change the limit in limits.conf but I encourage you not using join command here , maybe you can use "*stats ... by UserID" instead. You can also refer to <A href="https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html">https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html</A>.</P> Tue, 22 Oct 2019 23:28:22 GMT https://community.splunk.com/t5/Splunk-ITSI/Can-you-help-me-with-the-following-search-in-Splunk-IT-Service/m-p/459330#M1610 szhou_splunk 2019-10-22T23:28:22Z