topic Re: SPlunk queries not returning anything in table in Splunk Search

Why are Splunk queries not returning anything in table?

venugoski — Thu, 14 Sep 2023 17:10:53 GMT

Splunk queries not returning anything in table. I see events matching for these queries but nothing under 'Statistics' section.

index=address-validation RESP_MARKER | rex field=log "\"operationPath\"\:\"(?<path>\w+).*\"operationType\"\:\"(?<type>\w+).*\"region\"\:\"(?<reg>\w+).*" | table path, type, reg

2.

index=club-finder RESP_MARKER | rex field=log "\"operationPath\"\:\"\/(?<path>\w+).*\"operationType\"\:\"(?<type>\w+).*\"region\"\:\"(?<reg>\w+).*\"totalTime\"\:(?<timeTaken>\w+)" | table type, path, timeTaken, reg

Re: SPlunk queries not returning anything in table

richgalloway — Wed, 13 Sep 2023 19:22:21 GMT

The queries do not contain statistics-generating commands (stats, timechart, etc.) so there is nothing for the Statistics tab to show.

Re: SPlunk queries not returning anything in table

venugoski — Wed, 13 Sep 2023 20:16:05 GMT

i dont see the stats coming here with stats command as well

index=address-validation RESP_MARKER | rex field=log "\"operationPath\"\:\"(?<path>\w+).*\"operationType\"\:\"(?<type>\w+).*\"region\"\:\"(?<reg>\w+).*" | stats count by path, type, reg

Re: SPlunk queries not returning anything in table

richgalloway — Thu, 14 Sep 2023 14:15:01 GMT

Make sure the path, type, and reg fields are not null. The stats command will not return results for null groupBy fields.