topic Why is my timechart search producing some events with no _time values and other field values are displaced in the resulting table? in Splunk Search

Why is my timechart search producing some events with no _time values and other field values are displaced in the resulting table?

msalaverry — Wed, 26 Aug 2015 16:00:24 GMT

Hi,

I have this search:

host="myhost.com" NOT source=*access_log* AND "SearchA" | timechart span=1d dc(App) as NotAssigned 
| eval NotAssigned=NotAssigned+0 | appendcols [search SearchB 
| timechart span=1d sum(Count) as Assigned ] 
| eval Time=strftime(_time, "%d-%m") |table  Time, Assigned, NotAssigned

This seems to work ok, but sometimes one of those variables is shown with no time for some events, and I don't know why.

This is the case:

When I made the searches individually, this was displayed correctly. But in some moments, it looks like there are some _time values missing.
Like in the attached image, today is 26-08, but the table is showing until 25-08, and one of the variables was displaced a couple of days.

Do you know how to fix it? ...

Re: Why is my timechart search producing some events with no _time values and other field values are displaced in the resulting table?

somesoni2 — Wed, 26 Aug 2015 17:17:08 GMT

Try something like this

 host="myhost.com" NOT source=*access_log* AND "SearchA" | timechart span=1d dc(App) as NotAssigned 
 | eval NotAssigned=NotAssigned+0 | append [search SearchB 
 | timechart span=1d sum(Count) as Assigned ] | stats values(*) as * by _time
 | eval Time=strftime(_time, "%d-%m") |table  Time, Assigned, NotAssigned

Re: Why is my timechart search producing some events with no _time values and other field values are displaced in the resulting table?

msalaverry — Thu, 27 Aug 2015 14:49:14 GMT

Tried, but didn't work 😞 .. Why is this happening?

Re: Why is my timechart search producing some events with no _time values and other field values are displaced in the resulting table?

somesoni2 — Thu, 27 Aug 2015 16:52:19 GMT

It is due to appendcols as there could be different dates available for both the queries. Could you please tell what went wrong with the query I suggested?

Re: Why is my timechart search producing some events with no _time values and other field values are displaced in the resulting table?

msalaverry — Thu, 27 Aug 2015 18:41:37 GMT

Hey somesoni2... You were right, I updated the query and I missed to change appendcols to appen ...

Seems to be ok now... Thanks a lot!