https://community.splunk.com/t5/Splunk-Search/No-results-found-still-chart-and-stats-return-1/m-p/233908#M176191 <P>Hi,</P> <P>I have a query which returns no results:</P> <P>index="itsm" sourcetype=incidents | dedup NUMBER sortby OPEN_TIME | search STATUS!=Closed STATUS!=Resolved ASSIGNMENT="MY GROUP"</P> <P>but when I add chart or stats:</P> <P>index="itsm" sourcetype=incidents | dedup NUMBER sortby OPEN_TIME | search STATUS!=Closed STATUS!=Resolved ASSIGNMENT="MY GROUP" | chart count</P> <P>it returns 1 (but not always).</P> <P>Does someone have an explanation for this and a solution?</P> <P>Thanks.</P> <P>Regard, Hans van Straten</P> Mon, 21 Nov 2016 06:53:23 GMT stratenh 2016-11-21T06:53:23Z https://community.splunk.com/t5/Splunk-Search/No-results-found-still-chart-and-stats-return-1/m-p/233908#M176191 <P>Hi,</P> <P>I have a query which returns no results:</P> <P>index="itsm" sourcetype=incidents | dedup NUMBER sortby OPEN_TIME | search STATUS!=Closed STATUS!=Resolved ASSIGNMENT="MY GROUP"</P> <P>but when I add chart or stats:</P> <P>index="itsm" sourcetype=incidents | dedup NUMBER sortby OPEN_TIME | search STATUS!=Closed STATUS!=Resolved ASSIGNMENT="MY GROUP" | chart count</P> <P>it returns 1 (but not always).</P> <P>Does someone have an explanation for this and a solution?</P> <P>Thanks.</P> <P>Regard, Hans van Straten</P> Mon, 21 Nov 2016 06:53:23 GMT https://community.splunk.com/t5/Splunk-Search/No-results-found-still-chart-and-stats-return-1/m-p/233908#M176191 stratenh 2016-11-21T06:53:23Z https://community.splunk.com/t5/Splunk-Search/No-results-found-still-chart-and-stats-return-1/m-p/233909#M176192 <P>Are you fixing your Time Range or is it a Relative Time Range? That could explain the intermittence of 0 and 1 values</P> Mon, 21 Nov 2016 16:51:06 GMT https://community.splunk.com/t5/Splunk-Search/No-results-found-still-chart-and-stats-return-1/m-p/233909#M176192 TiagoTLD1 2016-11-21T16:51:06Z https://community.splunk.com/t5/Splunk-Search/No-results-found-still-chart-and-stats-return-1/m-p/233910#M176193 <P>It's a relative time range of 1 week. But swithing between the 2 queries back and forth didn't show any change in the results. The number of records is also very low. A couple of records per week after filtering on ASSIGNMENT. So I don't expect this to be the problem.</P> Tue, 22 Nov 2016 09:23:04 GMT https://community.splunk.com/t5/Splunk-Search/No-results-found-still-chart-and-stats-return-1/m-p/233910#M176193 stratenh 2016-11-22T09:23:04Z https://community.splunk.com/t5/Splunk-Search/No-results-found-still-chart-and-stats-return-1/m-p/233911#M176194 <P>At this moment I don't see the issue using a relative period of 1 week. Just to be sure, I now used a fixed time frame specifying a period from Monday morning until the next Monday morning: it's still there. So a relative period is not the issue.</P> Wed, 23 Nov 2016 07:27:40 GMT https://community.splunk.com/t5/Splunk-Search/No-results-found-still-chart-and-stats-return-1/m-p/233911#M176194 stratenh 2016-11-23T07:27:40Z https://community.splunk.com/t5/Splunk-Search/No-results-found-still-chart-and-stats-return-1/m-p/233912#M176195 <P>Maybe some additional info will help.</P> <P>I created a dashboard with this query in it. I didn't notice the problem before we used the dashboard.</P> Wed, 23 Nov 2016 08:20:32 GMT https://community.splunk.com/t5/Splunk-Search/No-results-found-still-chart-and-stats-return-1/m-p/233912#M176195 stratenh 2016-11-23T08:20:32Z https://community.splunk.com/t5/Splunk-Search/No-results-found-still-chart-and-stats-return-1/m-p/233913#M176196 <P>My query was wrong. The dedup sorted nothing, because OPEN_TIME is the same. So sorting is different every time, as well as the remaining records after the dedup.</P> <P>Sorry for taking your time.</P> <P>Regards, Hans van Straten</P> Wed, 23 Nov 2016 15:18:10 GMT https://community.splunk.com/t5/Splunk-Search/No-results-found-still-chart-and-stats-return-1/m-p/233913#M176196 stratenh 2016-11-23T15:18:10Z