Alerting

Why does the "View Results in Splunk" link in alert emails lead to an empty search results page, setting a millisecond time range on the search?

kiran_p
Explorer

Query:

index=xyz | bin span=10m _time | stats count as Count by _time

Trigger condition:

where Count > 0

My alert is triggered and I receive an alert email. When I click on “View Results in Splunk” link in the email, I land on search results page, 'Statistics' tab. I notice that the time window displayed next to the search field is correctly set to "Last 10 minutes". Time window above the tabs (Events, Statistics, Visualization) is also correctly set last 10 minutes. (Eg: 4 events (10/19/16 2:10:00.000 PM to 10/19/16 2:20:00 PM)

However, when I click on a row displayed in tabular format in Statistics tab, and I see a popup with a different timestamp, with millisecond resolution. (2:10:00.000 to 2:10:00.001)

Clicking on "View Events" link in that pop-up leads to empty results page, because of the millisecond resolution.

Did anyone run into this before? If so, how did you fix it? We are using Splunk version 6.5.0.

0 Karma
1 Solution

kiran_p
Explorer

Solution:
An issue in Splunk UI suppresses _span field from the view in the GUI. When 'bin span=x _time' is used in the query, add 'eval _span=' to the end of the query.

View solution in original post

0 Karma

kiran_p
Explorer

Solution:
An issue in Splunk UI suppresses _span field from the view in the GUI. When 'bin span=x _time' is used in the query, add 'eval _span=' to the end of the query.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...