<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Existing Query returning no data in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Existing-Query-returning-no-data/m-p/370767#M109101</link>
    <description>&lt;P&gt;Start by fixing the case of the words &lt;CODE&gt;and&lt;/CODE&gt; and &lt;CODE&gt;EVAL&lt;/CODE&gt; everywhere.  &lt;CODE&gt;AND&lt;/CODE&gt; should always be in caps, &lt;CODE&gt;eval&lt;/CODE&gt; should be in lower case.  The latter is probably not the problem, but the former often will be.  I would bet that fixing the lower case &lt;CODE&gt;and&lt;/CODE&gt;s in the line near the end -- &lt;CODE&gt;| EVAL target= blah blah&lt;/CODE&gt; --  will resolve your immediate problem.&lt;/P&gt;

&lt;P&gt;After that, here are some suggestions to clean up the code and make it less convoluted.&lt;/P&gt;

&lt;HR /&gt;

&lt;P&gt;The whole thing can be made to read much more simply if you move all the literals and values for &lt;CODE&gt;Text&lt;/CODE&gt;, &lt;CODE&gt;eventorder&lt;/CODE&gt; and &lt;CODE&gt;source&lt;/CODE&gt; into a csv file.&lt;/P&gt;

&lt;P&gt;That way, everything before the &lt;CODE&gt;streamstats&lt;/CODE&gt; command becomes... &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;index=gateway host=sc58lgwap0* [| inputcsv mystatuslist.csv | table Text]
| table _time Text TXRoot
| join Text [| inputcsv mystatuslist.csv | table Text eventorder source]
| table _time Text TXRoot eventorder source
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;... which I think you'd agree is less confusing, yes?&lt;/P&gt;

&lt;HR /&gt;

&lt;P&gt;The part of the logic that I seriously wonder about is that this timechart only appears to be charting records where the source is "Customer Information", but it seems to be processing much more than that.   I'm not sure whether anything can be done in the middle of the search, since I don't know your data or your sales funnel.  &lt;/P&gt;

&lt;P&gt;The last couple of lines can probably be simplified to... &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| where target != "NA"  AND  source="Customer Information"
| timechart span=10m count by target
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;...and if not, at the very least to ...&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| where target != "NA"  AND  source="Customer Information"
| timechart span=10m  count(eval(target="Abandoned Pre Biller Creation")) as "Abandoned Pre Biller" 
count(eval(target="Offer Selection")) as "Offer Selection"  count(eval(target="Offer Customization")) as "Offer Customization" .....  more lines for all the others  ...  count(eval(target="Order Canceled")) as "Order Cancelled"
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;... if the order is critical, then you can prepend a number to the "target" literal to force the order.&lt;/P&gt;</description>
    <pubDate>Tue, 09 May 2017 22:52:38 GMT</pubDate>
    <dc:creator>DalJeanis</dc:creator>
    <dc:date>2017-05-09T22:52:38Z</dc:date>
    <item>
      <title>Existing Query returning no data</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Existing-Query-returning-no-data/m-p/370766#M109100</link>
      <description>&lt;P&gt;Hello everyone,&lt;BR /&gt;
We have a dashboard that contains a few panels that recently stopped returning data.  I've tried to figure out what has changed but no luck so far.  I was not the one who originally created the dashboard or the queries but used so that makes it more difficult.  Was hoping I could provide the query along with a transaction to compare to and try to get some assistance.  Let me know if I need to provide any other info.&lt;/P&gt;

&lt;P&gt;Query:&lt;BR /&gt;
index=gateway  host=sc58lgwap0*  (Text="START GTWY_ORDERING: BEGINNING NEW ORDERING SESSION"   OR Text="START ORDERING.CLOSE_MODAL: ON CLOSE CALLED"   OR Text="START ORDERING.NEW_CONNECT: NAVIGATED TO NEW CONNECT"   OR Text="START ORDERING.OFFER_SELECTION: NAVIGATED TO OFFER SELECTION"   OR Text="START ORDERING.OFFER_CUSTOMIZATION: LOADING OFFER CUSTOMIZATION"   OR Text="START ORDERING.CUSTOMER_VERIFICATION: NAVIGATED TO CUSTOMER VERIFICATION"   OR Text="START ORDERING.SCHEDULE_INSTALL: NAVIGATED TO SCHEDULE INSTALL"   OR Text="START ORDERING.ORDER_SUMMARY: NAVIGATED TO ORDER SUMMARY"   OR Text="START ORDERING.ORDER_CONFIRMATION: NAVIGATED TO ORDER CONFIRMATION"   OR Text="START ORDERING.CLOSE_CLICK: ORDER CONFIRMATION CLOSE CLICK") | EVAL eventorder = case(Text == "START GTWY_ORDERING: BEGINNING NEW ORDERING SESSION",1,       Text == "START ORDERING.NEW_CONNECT: NAVIGATED TO NEW CONNECT",2,       Text == "START ORDERING.OFFER_SELECTION: NAVIGATED TO OFFER SELECTION",3,       Text == "START ORDERING.OFFER_CUSTOMIZATION: LOADING OFFER CUSTOMIZATION",4, Text == "START ORDERING.CUSTOMER_VERIFICATION: NAVIGATED TO CUSTOMER VERIFICATION",5,       Text == "START ORDERING.SCHEDULE_INSTALL: NAVIGATED TO SCHEDULE INSTALL",6,       Text == "START ORDERING.ORDER_SUMMARY: NAVIGATED TO ORDER SUMMARY",7,       Text == "START ORDERING.ORDER_CONFIRMATION: NAVIGATED TO ORDER CONFIRMATION",8,       Text == "START ORDERING.CLOSE_CLICK: ORDER CONFIRMATION CLOSE CLICK",9,       Text == "START ORDERING.CLOSE_MODAL: ON CLOSE CALLED",100) | EVAL source = case(Text == "START GTWY_ORDERING: BEGINNING NEW ORDERING SESSION","Order Start",       Text == "START ORDERING.NEW_CONNECT: NAVIGATED TO NEW CONNECT","Customer Information",Text == "START ORDERING.OFFER_SELECTION: NAVIGATED TO OFFER SELECTION","Offer Selection", Text == "START ORDERING.OFFER_CUSTOMIZATION: LOADING OFFER CUSTOMIZATION","Offer Customization", Text == "START ORDERING.CUSTOMER_VERIFICATION: NAVIGATED TO CUSTOMER VERIFICATION","Customer Verification", Text == "START ORDERING.SCHEDULE_INSTALL: NAVIGATED TO SCHEDULE INSTALL","Schedule Install",       Text == "START ORDERING.ORDER_SUMMARY: NAVIGATED TO ORDER SUMMARY","Order Summary",       Text == "START ORDERING.ORDER_CONFIRMATION: NAVIGATED TO ORDER CONFIRMATION","Order Confirmation",       Text == "START ORDERING.CLOSE_CLICK: ORDER CONFIRMATION CLOSE CLICK","Order Complete",       Text == "START ORDERING.CLOSE_MODAL: ON CLOSE CALLED","Order Canceled")  | streamstats current=f last(source) as nextevent1 by TxRoot | streamstats current=f last(eventorder) as nexteventorder1 by TxRoot   | EVAL nextevent2=coalesce(nextevent1,"NA") | EVAL nexteventorder=coalesce(nexteventorder1,101) | where eventorder &amp;lt; nexteventorder | EVAL target = case(nextevent2 == "NA" and eventorder &amp;lt;= 4 ,"Abandoned Pre Biller Creation",       nextevent2 == "NA" and eventorder != 100 and eventorder != 9,"Abandoned Post Biller Creation",        1 == 1, nextevent2) | where target != "NA"  | timechart span=10m count(eval(target="Abandoned Pre Biller Creation" AND source="Customer Information")) as "Abandoned Pre Biller" count(eval(target="Offer Selection" AND source="Customer Information")) as "Offer Selection" count(eval(target="Offer Customization" AND source="Customer Information")) as "Offer Customization" count(eval(target="Customer Verification" AND source="Customer Information")) as "Customer Verification" count(eval(target="Schedule Install" AND source="Customer Information")) as "Schedule Install" count(eval(target="Order Summary" AND source="Customer Information")) as "Order Summary" count(eval(target="Order Confirmation" AND source="Customer Information")) as "Order Confirmation" count(eval(target="Order Complete" AND source="Customer Information")) as "Order Complete" count(eval(target="Abandoned Post Biller Creation" AND source="Customer Information")) as "Abandoned Post Biller Creation" count(eval(target="Order Canceled" AND source="Customer Information")) as "Order Cancelled"&lt;/P&gt;

&lt;P&gt;Example of An Order which is what is being evaluated (Text Field and Time Stamp):&lt;BR /&gt;
_time   Text&lt;BR /&gt;
2017-05-09T15:24:03.684-0500    START ORDERING.CLOSE_CLICK: ORDER CONFIRMATION CLOSE CLICK&lt;BR /&gt;
2017-05-09T15:23:58.782-0500    START ORDERING.ORDER_CONFIRMATION: NAVIGATED TO ORDER CONFIRMATION&lt;BR /&gt;
2017-05-09T15:23:58.782-0500    ORDER CONFIRMATION SUCCESS&lt;BR /&gt;
2017-05-09T15:23:58.782-0500    START OrderingModel.postUpdateOrderConfirmation: CONFIRM ORDER&lt;BR /&gt;
2017-05-09T15:23:58.782-0500    UPDATE SCHEDULE SUCCESS&lt;BR /&gt;
2017-05-09T15:23:58.782-0500    UPDATE SCHEDULE COMPLETE&lt;BR /&gt;
2017-05-09T15:23:57.741-0500    UPDATE EMAIL SUCCESS&lt;BR /&gt;
2017-05-09T15:23:57.741-0500    CUSTOMER PII SUCCESS&lt;BR /&gt;
2017-05-09T15:23:56.735-0500    START OrderingModel.putCustomerPiiInfo: CUSTOMER PII INFO&lt;BR /&gt;
2017-05-09T15:23:56.735-0500    START OrderingModel.setSchedule: SETTING SCHEDULE&lt;BR /&gt;
2017-05-09T15:23:56.735-0500    START OrderingModel.setSchedule: UPDATE SCHEDULE&lt;BR /&gt;
2017-05-09T15:23:56.735-0500    START OrderingModel.postCustomerEmail: UPDATE EMAIL&lt;BR /&gt;
2017-05-09T15:23:56.735-0500    START ORDERING.SUBMIT_CLICK: SUBMIT ORDER BUTTON CLICK&lt;BR /&gt;
2017-05-09T15:23:55.599-0500    START DISCLAIMERS CHECKBOX CLICK: DISCLAIMERS CHECKBOX CLICK&lt;BR /&gt;
2017-05-09T15:23:55.598-0500    START INSTALLATION INFORMATION CHECKBOX CLICK: INSTALLATION INFORMATION CHECKBOX CLICK&lt;BR /&gt;
2017-05-09T15:23:54.559-0500    GET STATEMENTS SUCCESSFUL&lt;BR /&gt;
2017-05-09T15:23:54.559-0500    START BILLING SUMMARY CHECKBOX CLICK: BILLING SUMMARY CHECKBOX CLICK&lt;BR /&gt;
2017-05-09T15:23:53.146-0500    START Billing.StatementModel.getStatements: GET STATEMENTS&lt;BR /&gt;
2017-05-09T15:23:53.146-0500    START CHECK_FOR_STORE_INFO: CHECK FOR STORE INFO&lt;BR /&gt;
2017-05-09T15:23:53.146-0500    START ORDERING.ORDER_SUMMARY: NAVIGATED TO ORDER SUMMARY&lt;BR /&gt;
2017-05-09T15:23:51.110-0500    START UI:PREFCOMM:PREFERENCES_LOAD:&lt;BR /&gt;
2017-05-09T15:23:51.110-0500    Contact preferences created successfully&lt;BR /&gt;
2017-05-09T15:23:51.110-0500    Contact preferences created successfully&lt;BR /&gt;
2017-05-09T15:23:50.113-0500    START UI:PREFCOMM:CONTACT_PT_ADD_PREFERENCES:  - 112009179&lt;BR /&gt;
2017-05-09T15:23:50.113-0500    START UI:PREFCOMM:CONTACT_PT_ADD_PREFERENCES:  - 112009181&lt;BR /&gt;
2017-05-09T15:23:50.113-0500    START UI:PREFCOMM:ACCOUNT_SAVE:  - 835*&lt;BR /&gt;
2017-05-09T15:23:47.198-0500    START UI:PREFCOMM:PREFERENCES_LOAD:&lt;BR /&gt;
2017-05-09T15:23:47.198-0500    START UI:PREFCOMM:CONTACT_PT_LOAD:&lt;BR /&gt;
2017-05-09T15:23:47.198-0500    START UI:PREFCOMM:EVENT_FAMILY_LOAD:&lt;BR /&gt;
2017-05-09T15:23:47.198-0500    START UI:PREFCOMM:CONTACT_PT_LOAD:&lt;BR /&gt;
2017-05-09T15:23:46.199-0500    START UI:PREFCOMM:COMM_CONTACT_ADD:&lt;BR /&gt;
2017-05-09T15:23:45.203-0500    START UI:PREFCOMM:COMM_CONTACT_LOAD:&lt;BR /&gt;
2017-05-09T15:23:45.203-0500    START UI:PREFCOMM:CONTACT_ALL_LOAD:&lt;BR /&gt;
2017-05-09T15:23:45.203-0500    START ORDERING.CONTACT_PREFERENCES: NAVIGATED TO CONTACT PREFERENCES&lt;BR /&gt;
2017-05-09T15:23:45.203-0500    UPDATE SCHEDULE COMPLETE&lt;BR /&gt;
2017-05-09T15:23:42.689-0500    START OrderingModel.setSchedule: SETTING SCHEDULE&lt;BR /&gt;
2017-05-09T15:23:42.689-0500    START ORDERING.NEXT_CLICK: SCHEDULING NEXT BUTTON CLICK&lt;BR /&gt;
2017-05-09T15:22:59.355-0500    GET SELECTED WINDOW COMPLETE&lt;BR /&gt;
2017-05-09T15:22:56.309-0500    START OrderingModel.getSelectedWindow: GET SELECTED WINDOW&lt;BR /&gt;
2017-05-09T15:22:56.309-0500    NEW SCHEDULE WINDOWS COMPLETE&lt;BR /&gt;
2017-05-09T15:22:52.246-0500    START OrderingModel.getSchedules: REQUEST NEW SCHEDULE WINDOWS CALLED&lt;BR /&gt;
2017-05-09T15:22:52.246-0500    START ORDERING.SCHEDULE_INSTALL: NAVIGATED TO SCHEDULE INSTALL&lt;BR /&gt;
2017-05-09T15:22:52.246-0500    TPV PIN ORDER REQUEST PROCESSED&lt;BR /&gt;
2017-05-09T15:22:50.967-0500    START OrderingModel.initiateTPVPin: TPV PIN REQUEST INITIATED&lt;BR /&gt;
2017-05-09T15:22:50.967-0500    SUBMIT ORDER SENT TO BILLER&lt;BR /&gt;
2017-05-09T15:22:40.275-0500    START OrderingModel.submitBillerOrder: SUBMIT ORDER&lt;BR /&gt;
2017-05-09T15:22:40.275-0500    VALIDATE ORDER SUCCESS&lt;BR /&gt;
2017-05-09T15:22:39.004-0500    START OrderingModel.validateOrder: VALIDATE ORDER&lt;BR /&gt;
2017-05-09T15:22:39.004-0500    START ORDERING.NEXT_CLICK: OFFER CUSTOMIZATION MISCELLANEOUS NEXT BUTTON CLICK&lt;BR /&gt;
2017-05-09T15:22:37.774-0500    START ORDERING.GET_RTCSR_CONFIG: GET RTCSR CONFIG&lt;BR /&gt;
2017-05-09T15:22:37.774-0500    VALIDATE ORDER SUCCESS&lt;BR /&gt;
2017-05-09T15:22:36.771-0500    START OrderingModel.validateOrder: VALIDATE ORDER&lt;BR /&gt;
2017-05-09T15:22:36.771-0500    START OrderingModel.validateMiscProduct: VALIDATE MISCELLANEOUS PRODUCT ON MISC LOAD&lt;BR /&gt;
2017-05-09T15:22:36.771-0500    START ORDERING.OFFER_CUSTOMIZATION_MISC: NAVIGATED TO OFFER CUSTOMIZATION MISCELLANEOUS&lt;BR /&gt;
2017-05-09T15:22:36.771-0500    START ORDERING.NEXT_CLICK: CUSTOMER VERIFICATION NEXT BUTTON CLICK&lt;BR /&gt;
2017-05-09T15:22:35.094-0500    CREDIT CHECK COMPLETE (CUSTOMER FOUND)&lt;BR /&gt;
2017-05-09T15:22:34.087-0500    START OrderingModel.verifyCustomer: CREDIT CHECK&lt;BR /&gt;
2017-05-09T15:22:34.087-0500    START ORDERING.VERIFY_CLICK: VERIFY CUSTOMER CLICKED&lt;BR /&gt;
2017-05-09T15:22:07.413-0500    START ORDERING.CUSTOMER_VERIFICATION: NAVIGATED TO CUSTOMER VERIFICATION&lt;BR /&gt;
2017-05-09T15:22:07.413-0500    GET SELF INSTALL ELIGIBILITY SUCCESS&lt;BR /&gt;
2017-05-09T15:22:06.394-0500    START OrderingModel.checkSelfInstallEligibility: GET SELF INSTALL ELIGIBILITY&lt;BR /&gt;
2017-05-09T15:22:06.393-0500    VALIDATE ORDER SUCCESS&lt;BR /&gt;
2017-05-09T15:22:04.803-0500    START OrderingModel.validateOrder: VALIDATE ORDER&lt;BR /&gt;
2017-05-09T15:22:04.803-0500    START ORDERING.NEXT_CLICK: OFFER CUSTOMIZATION LOB NEXT BUTTON CLICK&lt;BR /&gt;
2017-05-09T15:22:03.408-0500    START ORDERING.DONE_CLICK: HOST TN POPUP DONE BUTTON CLICK&lt;BR /&gt;
2017-05-09T15:21:39.825-0500    GET TELEPHONE NUMBER INVENTORY SUCCESS&lt;BR /&gt;
2017-05-09T15:21:39.825-0500    GET AREA CODE AND EXCHANGES SUCCESS&lt;BR /&gt;
2017-05-09T15:21:38.810-0500    START OrderingModel.getAvailableExchanges: GET AREA CODE AND EXCHANGES&lt;BR /&gt;
2017-05-09T15:21:38.810-0500    START OrderingModel.getAvailableTNListing: GET TELEPHONE NUMBER INVENTORY&lt;BR /&gt;
2017-05-09T15:21:38.810-0500    START ORDERING.HOST_PHONE_NUMBER_MODEL: HOST BUTTON CLICK&lt;BR /&gt;
2017-05-09T15:21:36.349-0500    START ORDERING.GET_RTCSR_CONFIG: GET RTCSR CONFIG&lt;BR /&gt;
2017-05-09T15:21:36.349-0500    START ORDERING.VOICE_LOB_WINDOW_OPEN: AttachmentPurpose: +LB, URL: &lt;A href="https://chtrgwy.corp.chartercom.com:443/static/mec_attach/POP_UP_VOICE_MAIN.html" target="_blank"&gt;https://chtrgwy.corp.chartercom.com:443/static/mec_attach/POP_UP_VOICE_MAIN.html&lt;/A&gt; - BATTERY BACKUP WINDOW DISPLAYED&lt;BR /&gt;
2017-05-09T15:21:13.196-0500    GET QUOTE SUCCESSFUL&lt;BR /&gt;
2017-05-09T15:21:11.695-0500    ORDER REASONS SUCCESS&lt;BR /&gt;
2017-05-09T15:21:11.695-0500    START OrderingModel.getQuote: GET QUOTE&lt;BR /&gt;
2017-05-09T15:21:11.695-0500    START ORDERING.OFFER_CUSTOMIZATION: LOADING OFFER CUSTOMIZATION&lt;BR /&gt;
2017-05-09T15:21:11.695-0500    START OrderingModel.getOrderReasons: ORDER REASONS&lt;BR /&gt;
2017-05-09T15:21:11.695-0500    START ORDERING.OFFER_CUSTOMIZATION: NAVIGATED TO OFFER CUSTOMIZATION&lt;BR /&gt;
2017-05-09T15:21:11.695-0500    START ORDERING.NEXT_CLICK: OFFER SELECTION NEXT BUTTON CLICK&lt;BR /&gt;
2017-05-09T15:21:06.390-0500    START ORDERING.OFFER_SELECTED: OFFERS SELECTED&lt;BR /&gt;
2017-05-09T15:21:02.910-0500    OFFERS RECEIVED&lt;BR /&gt;
2017-05-09T15:21:02.910-0500    START Ordering.Model.getOffers: GET OFFERS&lt;BR /&gt;
2017-05-09T15:21:02.909-0500    FILTER FACETS RECEIVED&lt;BR /&gt;
2017-05-09T15:21:01.883-0500    START ORDERING.Ordering.Model.getFilterFacets: GET FILTER FACETS&lt;BR /&gt;
2017-05-09T15:21:01.883-0500    START ORDERING.OFFER_SELECTION: NAVIGATED TO OFFER SELECTION&lt;BR /&gt;
2017-05-09T15:21:01.883-0500    VERIFY ALL TELEPHONE NUMBERS SUCCESSFUL&lt;BR /&gt;
2017-05-09T15:21:01.883-0500    TELEPHONE NUMBER VALIDATED: (706) 218-7393&lt;BR /&gt;
2017-05-09T15:21:01.883-0500    TELEPHONE NUMBER VALIDATED: (706) 847-9832&lt;BR /&gt;
2017-05-09T15:21:01.883-0500    START ORDERING.OrderingModel.verifyTN: Verifying All Telephone Numbers&lt;BR /&gt;
2017-05-09T15:21:01.883-0500    START OrderingModel.verifyTN: Verifying Telephone Number: (706) 847-9832&lt;BR /&gt;
2017-05-09T15:21:01.883-0500    START OrderingModel.verifyTN: Verifying Telephone Number: (706) 218-7393&lt;BR /&gt;
2017-05-09T15:21:01.883-0500    START ORDERING.NEXT_CLICK: CUSTOMER INFORMATION NEXT BUTTON CLICK&lt;BR /&gt;
2017-05-09T15:18:14.805-0500    LOCATION SERVICEABLE&lt;BR /&gt;
2017-05-09T15:18:14.805-0500    SERVICEABILITY PROCESSED&lt;BR /&gt;
2017-05-09T15:18:14.805-0500    SERVICEABILITY PROCESSED&lt;BR /&gt;
2017-05-09T15:18:14.805-0500    SERVICEABILITY PROCESSED&lt;BR /&gt;
2017-05-09T15:18:13.785-0500    START GET_SERVICEABILITIES: GETTING SERVICEABILITY&lt;BR /&gt;
2017-05-09T15:18:13.785-0500    START GET_SERVICEABILITIES: GETTING SERVICEABILITY&lt;BR /&gt;
2017-05-09T15:18:13.785-0500    START GET_SERVICEABILITIES: GETTING SERVICEABILITY&lt;BR /&gt;
2017-05-09T15:18:13.785-0500    START ORDERING.OrderingModel.getServiceability: LOADING SERVICEABILITY&lt;BR /&gt;
2017-05-09T15:18:13.785-0500    START GTWY_ORDERING: BEGINNING NEW ORDERING SESSION&lt;BR /&gt;
2017-05-09T15:18:13.785-0500    START ORDERING.NEW_CONNECT: NAVIGATED TO NEW CONNECT&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 14:00:06 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Existing-Query-returning-no-data/m-p/370766#M109100</guid>
      <dc:creator>kmccowen</dc:creator>
      <dc:date>2020-09-29T14:00:06Z</dc:date>
    </item>
    <item>
      <title>Re: Existing Query returning no data</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Existing-Query-returning-no-data/m-p/370767#M109101</link>
      <description>&lt;P&gt;Start by fixing the case of the words &lt;CODE&gt;and&lt;/CODE&gt; and &lt;CODE&gt;EVAL&lt;/CODE&gt; everywhere.  &lt;CODE&gt;AND&lt;/CODE&gt; should always be in caps, &lt;CODE&gt;eval&lt;/CODE&gt; should be in lower case.  The latter is probably not the problem, but the former often will be.  I would bet that fixing the lower case &lt;CODE&gt;and&lt;/CODE&gt;s in the line near the end -- &lt;CODE&gt;| EVAL target= blah blah&lt;/CODE&gt; --  will resolve your immediate problem.&lt;/P&gt;

&lt;P&gt;After that, here are some suggestions to clean up the code and make it less convoluted.&lt;/P&gt;

&lt;HR /&gt;

&lt;P&gt;The whole thing can be made to read much more simply if you move all the literals and values for &lt;CODE&gt;Text&lt;/CODE&gt;, &lt;CODE&gt;eventorder&lt;/CODE&gt; and &lt;CODE&gt;source&lt;/CODE&gt; into a csv file.&lt;/P&gt;

&lt;P&gt;That way, everything before the &lt;CODE&gt;streamstats&lt;/CODE&gt; command becomes... &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;index=gateway host=sc58lgwap0* [| inputcsv mystatuslist.csv | table Text]
| table _time Text TXRoot
| join Text [| inputcsv mystatuslist.csv | table Text eventorder source]
| table _time Text TXRoot eventorder source
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;... which I think you'd agree is less confusing, yes?&lt;/P&gt;

&lt;HR /&gt;

&lt;P&gt;The part of the logic that I seriously wonder about is that this timechart only appears to be charting records where the source is "Customer Information", but it seems to be processing much more than that.   I'm not sure whether anything can be done in the middle of the search, since I don't know your data or your sales funnel.  &lt;/P&gt;

&lt;P&gt;The last couple of lines can probably be simplified to... &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| where target != "NA"  AND  source="Customer Information"
| timechart span=10m count by target
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;...and if not, at the very least to ...&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| where target != "NA"  AND  source="Customer Information"
| timechart span=10m  count(eval(target="Abandoned Pre Biller Creation")) as "Abandoned Pre Biller" 
count(eval(target="Offer Selection")) as "Offer Selection"  count(eval(target="Offer Customization")) as "Offer Customization" .....  more lines for all the others  ...  count(eval(target="Order Canceled")) as "Order Cancelled"
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;... if the order is critical, then you can prepend a number to the "target" literal to force the order.&lt;/P&gt;</description>
      <pubDate>Tue, 09 May 2017 22:52:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Existing-Query-returning-no-data/m-p/370767#M109101</guid>
      <dc:creator>DalJeanis</dc:creator>
      <dc:date>2017-05-09T22:52:38Z</dc:date>
    </item>
    <item>
      <title>Re: Existing Query returning no data</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Existing-Query-returning-no-data/m-p/370768#M109102</link>
      <description>&lt;P&gt;I've corrected the "and" and "eval" but they query is returning the save results which is all values of zeros.  &lt;/P&gt;

&lt;P&gt;time &lt;BR /&gt;
Abandoned Pre Biller &lt;BR /&gt;
Offer Selection &lt;BR /&gt;
Offer Customization &lt;BR /&gt;
Customer Verification &lt;BR /&gt;
Schedule Install &lt;BR /&gt;
Order Summary &lt;BR /&gt;
Order Confirmation &lt;BR /&gt;
Order Complete &lt;BR /&gt;
Abandoned Post Biller Creation &lt;BR /&gt;
Order Cancelled &lt;/P&gt;

&lt;P&gt;2017-05-03 07:00:00     0   0   0   0   0   0   0   0   0   0 &lt;BR /&gt;
2017-05-03 07:10:00     0   0   0   0   0   0   0   0   0   0 &lt;/P&gt;</description>
      <pubDate>Wed, 10 May 2017 12:54:36 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Existing-Query-returning-no-data/m-p/370768#M109102</guid>
      <dc:creator>kmccowen</dc:creator>
      <dc:date>2017-05-10T12:54:36Z</dc:date>
    </item>
    <item>
      <title>Re: Existing Query returning no data</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Existing-Query-returning-no-data/m-p/370769#M109103</link>
      <description>&lt;P&gt;Here is the fixed query with corrected "and" and "eval" &lt;/P&gt;

&lt;P&gt;index=gateway  host=sc58lgwap0*  (Text="START GTWY_ORDERING: BEGINNING NEW ORDERING SESSION"   OR Text="START ORDERING.CLOSE_MODAL: ON CLOSE CALLED"   OR Text="START ORDERING.NEW_CONNECT: NAVIGATED TO NEW CONNECT"   OR Text="START ORDERING.OFFER_SELECTION: NAVIGATED TO OFFER SELECTION"   OR Text="START ORDERING.OFFER_CUSTOMIZATION: LOADING OFFER CUSTOMIZATION"   OR Text="START ORDERING.CUSTOMER_VERIFICATION: NAVIGATED TO CUSTOMER VERIFICATION"   OR Text="START ORDERING.SCHEDULE_INSTALL: NAVIGATED TO SCHEDULE INSTALL"   OR Text="START ORDERING.ORDER_SUMMARY: NAVIGATED TO ORDER SUMMARY"   OR Text="START ORDERING.ORDER_CONFIRMATION: NAVIGATED TO ORDER CONFIRMATION"   OR Text="START ORDERING.CLOSE_CLICK: ORDER CONFIRMATION CLOSE CLICK") | eval eventorder = case(Text == "START GTWY_ORDERING: BEGINNING NEW ORDERING SESSION",1,       Text == "START ORDERING.NEW_CONNECT: NAVIGATED TO NEW CONNECT",2,       Text == "START ORDERING.OFFER_SELECTION: NAVIGATED TO OFFER SELECTION",3,       Text == "START ORDERING.OFFER_CUSTOMIZATION: LOADING OFFER CUSTOMIZATION",4, Text == "START ORDERING.CUSTOMER_VERIFICATION: NAVIGATED TO CUSTOMER VERIFICATION",5,       Text == "START ORDERING.SCHEDULE_INSTALL: NAVIGATED TO SCHEDULE INSTALL",6,       Text == "START ORDERING.ORDER_SUMMARY: NAVIGATED TO ORDER SUMMARY",7,       Text == "START ORDERING.ORDER_CONFIRMATION: NAVIGATED TO ORDER CONFIRMATION",8,       Text == "START ORDERING.CLOSE_CLICK: ORDER CONFIRMATION CLOSE CLICK",9,       Text == "START ORDERING.CLOSE_MODAL: ON CLOSE CALLED",100) | eval source = case(Text == "START GTWY_ORDERING: BEGINNING NEW ORDERING SESSION","Order Start",       Text == "START ORDERING.NEW_CONNECT: NAVIGATED TO NEW CONNECT","Customer Information",Text == "START ORDERING.OFFER_SELECTION: NAVIGATED TO OFFER SELECTION","Offer Selection", Text == "START ORDERING.OFFER_CUSTOMIZATION: LOADING OFFER CUSTOMIZATION","Offer Customization", Text == "START ORDERING.CUSTOMER_VERIFICATION: NAVIGATED TO CUSTOMER VERIFICATION","Customer Verification", Text == "START ORDERING.SCHEDULE_INSTALL: NAVIGATED TO SCHEDULE INSTALL","Schedule Install",       Text == "START ORDERING.ORDER_SUMMARY: NAVIGATED TO ORDER SUMMARY","Order Summary",       Text == "START ORDERING.ORDER_CONFIRMATION: NAVIGATED TO ORDER CONFIRMATION","Order Confirmation",       Text == "START ORDERING.CLOSE_CLICK: ORDER CONFIRMATION CLOSE CLICK","Order Complete",       Text == "START ORDERING.CLOSE_MODAL: ON CLOSE CALLED","Order Canceled")  | streamstats current=f last(source) as nextevent1 by TxRoot | streamstats current=f last(eventorder) as nexteventorder1 by TxRoot   | eval nextevent2=coalesce(nextevent1,"NA") | eval nexteventorder=coalesce(nexteventorder1,101) | where eventorder &amp;lt; nexteventorder | eval target = case(nextevent2 == "NA" AND eventorder &amp;lt;= 4 ,"Abandoned Pre Biller Creation",       nextevent2 == "NA" AND eventorder != 100 AND eventorder != 9,"Abandoned Post Biller Creation",        1 == 1, nextevent2) | where target != "NA"  | timechart span=10m count(eval(target="Abandoned Pre Biller Creation" AND source="Customer Information")) as "Abandoned Pre Biller" count(eval(target="Offer Selection" AND source="Customer Information")) as "Offer Selection" count(eval(target="Offer Customization" AND source="Customer Information")) as "Offer Customization" count(eval(target="Customer Verification" AND source="Customer Information")) as "Customer Verification" count(eval(target="Schedule Install" AND source="Customer Information")) as "Schedule Install" count(eval(target="Order Summary" AND source="Customer Information")) as "Order Summary" count(eval(target="Order Confirmation" AND source="Customer Information")) as "Order Confirmation" count(eval(target="Order Complete" AND source="Customer Information")) as "Order Complete" count(eval(target="Abandoned Post Biller Creation" AND source="Customer Information")) as "Abandoned Post Biller Creation" count(eval(target="Order Canceled" AND source="Customer Information")) as "Order Cancelled"&lt;/P&gt;</description>
      <pubDate>Tue, 29 Sep 2020 14:00:32 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Existing-Query-returning-no-data/m-p/370769#M109103</guid>
      <dc:creator>kmccowen</dc:creator>
      <dc:date>2020-09-29T14:00:32Z</dc:date>
    </item>
    <item>
      <title>Re: Existing Query returning no data</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Existing-Query-returning-no-data/m-p/370770#M109104</link>
      <description>&lt;P&gt;The order is critical like you said.  I'll try using new ending you provided and see if that changes the results. Thanks for the help!&lt;/P&gt;</description>
      <pubDate>Wed, 10 May 2017 12:56:25 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Existing-Query-returning-no-data/m-p/370770#M109104</guid>
      <dc:creator>kmccowen</dc:creator>
      <dc:date>2017-05-10T12:56:25Z</dc:date>
    </item>
    <item>
      <title>Re: Existing Query returning no data</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Existing-Query-returning-no-data/m-p/370771#M109105</link>
      <description>&lt;P&gt;Still no luck &lt;span class="lia-unicode-emoji" title=":disappointed_face:"&gt;😞&lt;/span&gt;  Any more suggestions?&lt;/P&gt;</description>
      <pubDate>Wed, 10 May 2017 13:40:10 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Existing-Query-returning-no-data/m-p/370771#M109105</guid>
      <dc:creator>kmccowen</dc:creator>
      <dc:date>2017-05-10T13:40:10Z</dc:date>
    </item>
  </channel>
</rss>

