https://community.splunk.com/t5/Monitoring-Splunk/Rapid7-search-error/m-p/451043#M6105 <P>Hello,</P> <P>I'm trying to use the search below but I only get 0 events. </P> <P>What Am I doing wrong?</P> <PRE><CODE>index=rapid7 sourcetype=* | eval site=coalesce(site, "") | eval asset=coalesce(asset_id, "") | search site=* status=Approved reason="Acceptable risk" | search [search index=rapid7 sourcetype="rapid7:nexpose:asset" | fields * | eval tag=coalesce(split(nexpose_tags,";"), "") | search tag="*" * vendor_product="*" site_id="*" pci_status="*" (hostname=* OR ip=* OR mac=*) | fields * | table asset_id hostname ip mac os site_name nexpose_tags os] | dedup site asset vulnerability_id | sort "Status" DESC | table status vulnerability_id title asset_id severity_score severity reason additional_comments submitted_by review_date review_comment expiration_date port key </CODE></PRE> Fri, 10 May 2019 12:32:30 GMT gustavobrgyn 2019-05-10T12:32:30Z https://community.splunk.com/t5/Monitoring-Splunk/Rapid7-search-error/m-p/451043#M6105 <P>Hello,</P> <P>I'm trying to use the search below but I only get 0 events. </P> <P>What Am I doing wrong?</P> <PRE><CODE>index=rapid7 sourcetype=* | eval site=coalesce(site, "") | eval asset=coalesce(asset_id, "") | search site=* status=Approved reason="Acceptable risk" | search [search index=rapid7 sourcetype="rapid7:nexpose:asset" | fields * | eval tag=coalesce(split(nexpose_tags,";"), "") | search tag="*" * vendor_product="*" site_id="*" pci_status="*" (hostname=* OR ip=* OR mac=*) | fields * | table asset_id hostname ip mac os site_name nexpose_tags os] | dedup site asset vulnerability_id | sort "Status" DESC | table status vulnerability_id title asset_id severity_score severity reason additional_comments submitted_by review_date review_comment expiration_date port key </CODE></PRE> Fri, 10 May 2019 12:32:30 GMT https://community.splunk.com/t5/Monitoring-Splunk/Rapid7-search-error/m-p/451043#M6105 gustavobrgyn 2019-05-10T12:32:30Z https://community.splunk.com/t5/Monitoring-Splunk/Rapid7-search-error/m-p/451044#M6106 <P>Your SPL has a few errors, perhaps because of the way the forum formats questions. Please edit the question to correct issues like "search site= status=...". It will be easier to help if we're looking at a valid query.</P> <P>A typical approach for debugging a query that returns zero events is to start with the base search and add one command at a time until no results are returned. The last command added is probably the cause.</P> Fri, 10 May 2019 14:39:41 GMT https://community.splunk.com/t5/Monitoring-Splunk/Rapid7-search-error/m-p/451044#M6106 richgalloway 2019-05-10T14:39:41Z