https://community.splunk.com/t5/Splunk-Search/Why-does-my-timechart-search-return-quot-No-results-found-quot/m-p/274711#M82858 <P>Yes, it returns a table of information, and that field is populated. </P> Sun, 07 Feb 2016 01:46:56 GMT a212830 2016-02-07T01:46:56Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-timechart-search-return-quot-No-results-found-quot/m-p/274709#M82856 <P>Hi,</P> <P>I have a search where Splunk data is joined with a lookup, and I need a timechart on one of the fields provided by the lookup, but I can't get it to work. Not sure what I'm doing wrong...</P> <P>Here's the search, which works fine. </P> <PRE><CODE>index=network sourcetype=ive_syslog host=*eraweb* "Primary authentication successful" | fields time, CORP_ID, host |dedup CORP_ID |table CORP_ID, host, time |eval location=case(host LIKE "%mmk%", "MMK", host LIKE "%rtd%", "RTP", host LIKE "%oma%", "OMA", host LIKE "%", "Others")|lookup tinypeople.csv CORP_ID OUTPUT CORP_ID, DISPLAY_NAME, COMPLETE_NAME, COST_CENTER, BUSINESS_UNIT_CODE, BUSINESS_GROUP_CODE, BUSINESS_GROUP_DESC, POSN_LOC_LOCALITY_CODE, BUSINESS_UNIT_DESC </CODE></PRE> <P>I tried adding a <CODE>|timechart count by BUSINESS_UNIT_DESC</CODE>, but it comes back with "No Results found". What am I doing wrong? </P> Sun, 07 Feb 2016 00:32:26 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-timechart-search-return-quot-No-results-found-quot/m-p/274709#M82856 a212830 2016-02-07T00:32:26Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-timechart-search-return-quot-No-results-found-quot/m-p/274710#M82857 <P>Can you confirm that in your search (without timechart) that the field "BUSINESS_UNIT_DESC" actually has data in it?</P> Tue, 29 Sep 2020 08:42:20 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-timechart-search-return-quot-No-results-found-quot/m-p/274710#M82857 Richfez 2020-09-29T08:42:20Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-timechart-search-return-quot-No-results-found-quot/m-p/274711#M82858 <P>Yes, it returns a table of information, and that field is populated. </P> Sun, 07 Feb 2016 01:46:56 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-timechart-search-return-quot-No-results-found-quot/m-p/274711#M82858 a212830 2016-02-07T01:46:56Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-timechart-search-return-quot-No-results-found-quot/m-p/274712#M82859 <P>Got it. Never mind.. Thanks!</P> Sun, 07 Feb 2016 02:15:10 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-timechart-search-return-quot-No-results-found-quot/m-p/274712#M82859 a212830 2016-02-07T02:15:10Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-timechart-search-return-quot-No-results-found-quot/m-p/274713#M82860 <P>Can you try this ?</P> <PRE><CODE>your search |eval BUSINESS_UNIT_DESC=coalesce(BUSINESS_UNIT_DESC,"NOT FOUND"|timechart count by BUSINESS_UNIT_DESC </CODE></PRE> Sun, 07 Feb 2016 02:17:41 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-timechart-search-return-quot-No-results-found-quot/m-p/274713#M82860 renjith_nair 2016-02-07T02:17:41Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-timechart-search-return-quot-No-results-found-quot/m-p/274714#M82861 <P>out of curiosity , what was the problem?</P> Sun, 07 Feb 2016 03:50:23 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-timechart-search-return-quot-No-results-found-quot/m-p/274714#M82861 renjith_nair 2016-02-07T03:50:23Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-timechart-search-return-quot-No-results-found-quot/m-p/274715#M82862 <P>Hi @a212830</P> <P>Can you confirm what the issue was and share the answer below for other users to resolve this post?</P> Sun, 07 Feb 2016 20:45:57 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-timechart-search-return-quot-No-results-found-quot/m-p/274715#M82862 ppablo 2016-02-07T20:45:57Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-timechart-search-return-quot-No-results-found-quot/m-p/274716#M82863 <P>Is the time field not in the final results? That one is critical for the timechart to work.</P> <P>Also, if you do <CODE>dedup</CODE> and then <CODE>table</CODE>, consider replacing both with a <CODE>stats</CODE> command for improved performance.</P> Fri, 12 Feb 2016 22:17:03 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-timechart-search-return-quot-No-results-found-quot/m-p/274716#M82863 sloshburch 2016-02-12T22:17:03Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-timechart-search-return-quot-No-results-found-quot/m-p/274717#M82864 <P>try this </P> <P><CODE>index=network sourcetype=ive_syslog host=*eraweb* "Primary authentication successful" <BR /> | lookup tinypeople.csv CORP_ID <BR /> | timechart count by BUSINESS_UNIT_DESC</CODE> </P> Thu, 26 Sep 2019 16:43:18 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-timechart-search-return-quot-No-results-found-quot/m-p/274717#M82864 Anantha123 2019-09-26T16:43:18Z