topic Re: Search with result shows No results Found error after 100% completion of the search in Splunk Search

Search with result shows No results Found error after 100% completion of the search

paramagurukarth — Tue, 26 May 2015 13:20:18 GMT

My search shows results when it is executing..
But after 100% completion of the search all the listed records are disappeared and "No records found error" is Displayed.
Please guide me how to find the issue..

Re: Search with result shows No results Found error after 100% completion of the search

richgalloway — Tue, 26 May 2015 15:47:58 GMT

One of your later search commands is processing your events and coming up with no results. What is your search?

Re: Search with result shows No results Found error after 100% completion of the search

rsennett_splunk — Tue, 26 May 2015 16:20:51 GMT

does it show "results" while executing or are you just seeing events returned? - And yes. we need to see your search.

Re: Search with result shows No results Found error after 100% completion of the search

intelsubham — Tue, 26 May 2015 16:46:48 GMT

Please share your search.
Also for finding issue, try to run your query in small parts,
like if your query is index=abc sourcetype=xyz | <part1> | <spart2> | stats <somefunction> by <field>
so first run normally before part 1 then with part 2 , this will help you in determining which part is creating issue.

Re: Search with result shows No results Found error after 100% completion of the search

paramagurukarth — Wed, 27 May 2015 11:14:41 GMT

Yes... You are both @intelsubham and @richgalloway are correct..
I am getting zero results due to a custom command in my query.
(Splunk docs.. says python custom command will returns only 50000 records.... and the last 50000 records are filtered by my query condition)..

Re: Search with result shows No results Found error after 100% completion of the search

woodcock — Sat, 06 Jun 2015 14:54:33 GMT

This is somewhat normal if you are piping to many "rolling up"-type commands (e.g. stats) because Splunk is designed to give you preliminary (NOT PARTIAL) results along the way while your search is processing. Normally this is very useful but in some cases like yours, it can be misleading and confusing. Such complicated searches also may take a while to finalize so that is normal, too. You should never forget that any search may show preliminary results that are later properly vacated using the plenary results in the finalization stage. If you believe that you should have results, then you almost certainly have a mistake in your search string. To find the mistake, throw away each post-pipe clause, one by one, starting from the right side and make sure at each stage that the preliminary stages' results look the way they should. As the others have said, we really cannot tell more without your exact search and some real sample data.