topic why it is not giving the results of all commands but on the 90 days command in Splunk Search

why it is not giving the results of all commands but on the 90 days command

haripotu — Tue, 15 Jun 2021 06:30:33 GMT

bin _time span=1d |stats count by _time

| eval time_chunk = case(
_time > relative_time(now(), "-30d") AND _time < relative_time(now(), "-45d"), "Applications sits in New Applications Status > 30 days",
_time > relative_time(now(), "-45d") AND _time < relative_time(now(), "-60d"), "Applications sits in New Applications Status > 45 days",
_time > relative_time(now(), "-60d") AND _time < relative_time(now(), "-90d"), "Applications sits in New Applications Status > 60 days",
_time > relative_time(now(), "-90d") ,"Applications sits in New Applications Status > 90 days")
| stats count by time_chunk

Re: why it is not giving the results of all commands but on the 90 days command

gcusello — Tue, 15 Jun 2021 07:00:38 GMT

Hi @haripotu,

what's the retention of the index that you're using in your search?

probably it has a retention of 90 days.

If you want to have older information, you have to enlarge the retention of that index, but, as you know, it has also a larger storage consuption (not license).

Ciao.

Giuseppe

Re: why it is not giving the results of all commands but on the 90 days command

haripotu — Tue, 15 Jun 2021 07:02:29 GMT

The data has only 16 events. it is not pulling that data.

Re: why it is not giving the results of all commands but on the 90 days command

kamlesh_vaghela — Tue, 15 Jun 2021 08:12:37 GMT

@haripotu

Can you please try this?

| bin _time span=1d | stats count by _time | eval time_chunk = case( _time > relative_time(now(), "-45d") AND _time < relative_time(now(), "-30d"), "Applications sits in New Applications Status > 30 days", _time > relative_time(now(), "-60d") AND _time < relative_time(now(), "-45d"), "Applications sits in New Applications Status > 45 days", _time > relative_time(now(), "-90d") AND _time < relative_time(now(), "-60d"), "Applications sits in New Applications Status > 60 days", _time > relative_time(now(), "-90d") ,"Applications sits in New Applications Status > 90 days") | stats count by time_chunk

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: why it is not giving the results of all commands but on the 90 days command

haripotu — Tue, 15 Jun 2021 08:50:24 GMT

Hey Hi!

I am getting result for 45 days, 60 days, but not for 90+days.