topic Re: Contingency: no results found in Splunk Search

Contingency: no results found

arpoador — Fri, 01 Nov 2013 18:17:29 GMT

I have two fields: EventCode (66 distinct values) and date_mday (28 distinct values)

But when I run:

' * | contingency EventCode date_mday '

On over 1.2M events I get no results. What am I doing wrong?
Thanks

Also, suggestion: If a field is mistyped, show it in red if it doesn't exist.

Re: Contingency: no results found

somesoni2 — Fri, 01 Nov 2013 19:47:18 GMT

Could you try to give proper index/sourcetype name instead of using *??

Re: Contingency: no results found

loatswil — Fri, 01 Nov 2013 20:03:16 GMT

If those are indeed valid fields in the search, I'd look at the time frame. Make sure those events did occur during the selected time frame.

Re: Contingency: no results found

arpoador — Fri, 01 Nov 2013 21:50:42 GMT

I used * just to make sure I was looking at the entire event set in case I was missing something. When I changed contingency to ctable (and changed nothing else), I get the table I expected. Interesting. Thanks for your reply.