topic Re: Query not displaying any events in Splunk Search

Query not displaying any events

pratapa — Wed, 30 Sep 2020 04:33:22 GMT

User complained that following query is not displaying any events.

what could be the problem in the above query.

Re: Query not displaying any events

richgalloway — Thu, 12 Mar 2020 12:52:01 GMT

One possibility is there are no events to display.
Another possibility is one of the fields in the by clause of stats is null. That will cause stats to return no results.

Re: Query not displaying any events

gcusello — Thu, 12 Mar 2020 13:00:29 GMT

Hi @pratapa,
I see that you filter your results for warehouse=wk that's one of the BY clause fields in the first stats command, it's always better to filter in the main search so you don't need it in the first stats, in addition the clause machine isn't used so you don't need the two stats commands.
so you could simplify your search in this way:

index=main sourcetype=wms_oracle_sessions warehouse=wk
| timechart span=5m count by program

Ciao.
Giuseppe

Re: Query not displaying any events

pratapa — Wed, 30 Sep 2020 04:33:39 GMT

Thanks for your reply.

We tried modifying the query as follows but No results found.

index=main sourcetype=wms_oracle_sessions warehouse=wk | bucket span=5m _time | stats count AS sessions by _time,warehouse,machine,program| stats sum(sessions) AS psessions by _time,program | timechart avg(psessions) by program

We tried the below query as well, but no results found.

index=main sourcetype=wms_oracle_sessions warehouse=wk | timechart span=5m count by program

Even when we try the below ones, no results found.

index=main sourcetype=wms_oracle_sessions warehouse=wk

index=main sourcetype=wms_oracle_sessions

sourcetype=wms_oracle_sessions

It seems source type wms_oracle_sessions does not exist. Please suggest what can be done.

Re: Query not displaying any events

richgalloway — Fri, 13 Mar 2020 12:42:19 GMT

Searching only for sourcetype may not work, depending on your default index(es). Try index=* sourcetype=wms_oracle_sessions. If that returns nothing then you need to investigate why you are not receiving any data of that source type.

Re: Query not displaying any events

to4kawa — Sat, 14 Mar 2020 21:05:33 GMT

Query not displaying any events
Where?
1st stats?
search?
2nd stats?
last timechart?

SPL runs in order.
Please run the query line by line.
You can find where the problem is.
Good luck.

Re: Query not displaying any events

woodcock — Sat, 14 Mar 2020 22:04:50 GMT

Try this:

index="main" AND sourcetype="wms_oracle_sessions" AND warehouse="wk"
| bucket _time span=5m
| stats count AS sessions BY _time warehouse machine program
| stats sum(sessions) AS psessions BY _time program
| stats avg(psessions) BY program