topic Search Only Returning One Column in Knowledge Management

Search Only Returning One Column

whod81 — Thu, 18 Oct 2012 16:38:11 GMT

Here is the search, putting results in a summary index.

sourcetype="SmtpPrevent_operational" dtime=*s | convert auto(dtime) | search dtime>=60 | sitimechart span=1h count(dtime>=60), count(dtime>=120), count(dtime>=180)

(longhand version)

sourcetype="SmtpPrevent_operational" dtime=*s | convert auto(dtime) | search dtime>=60 | sitimechart span=1h count(dtime>=60), count(dtime>=120), count(dtime>=180) | summaryindex spool=t uselb=t addtime=t index="dtime_plus_60" file="Summary Index DTime 60+,120+,180+ per Hour_1480261911.stash_new" name="Summary Index DTime 60+,120+,180+ per Hour" marker=""

Now here is what ends up being in the summary index:

10/18/2012 10:00:00, search_name="Summary Index DTime 60+,120+,180+ per Hour", search_now=1350576300.000, info_min_time=1350568800.000, info_max_time=1350572400.000, info_search_time=1350576324.840, psrsvd_gc=27, psrsvd_v=1

Re: Search Only Returning One Column

Lucas_K — Mon, 28 Sep 2020 12:39:58 GMT

If you just use a normal timechart command are you getting the expected results (3 groups) from your search?

Your summary index output seems to reflect only 1 count of results (no grouping!) being saved (as per your question).

edit: Actually, looking at your search I wouldn't have expected "count(dtime>=60), count(dtime>=120), count(dtime>=180)" to actually output anything.

So your original search needs to be fixed with something like this perhaps :

| eval dtime_group=case(dtime <= "60" , "less60", dtime >= "61" AND dtime <= "120", "lessthan120", dtime >="180", "lessthan180") | timechart count by dtime_group

Re: Search Only Returning One Column

whod81 — Tue, 23 Oct 2012 15:30:57 GMT

The non-si version of the search properly returns 3 columns.

sourcetype=\"SmtpPrevent_operational\" dtime=*s | convert auto(dtime) | search dtime>=60 | timechart span=1d count(eval(dtime>=60)) as 60+, count(eval(dtime>=120)) as 120+, count(eval(dtime>=180)) as 180+'