Alerting

Why does the "View Results in Splunk" link in alert emails lead to an empty search results page, setting a millisecond time range on the search?

kiran_p
Explorer

Query:

index=xyz | bin span=10m _time | stats count as Count by _time

Trigger condition:

where Count > 0

My alert is triggered and I receive an alert email. When I click on “View Results in Splunk” link in the email, I land on search results page, 'Statistics' tab. I notice that the time window displayed next to the search field is correctly set to "Last 10 minutes". Time window above the tabs (Events, Statistics, Visualization) is also correctly set last 10 minutes. (Eg: 4 events (10/19/16 2:10:00.000 PM to 10/19/16 2:20:00 PM)

However, when I click on a row displayed in tabular format in Statistics tab, and I see a popup with a different timestamp, with millisecond resolution. (2:10:00.000 to 2:10:00.001)

Clicking on "View Events" link in that pop-up leads to empty results page, because of the millisecond resolution.

Did anyone run into this before? If so, how did you fix it? We are using Splunk version 6.5.0.

0 Karma
1 Solution

kiran_p
Explorer

Solution:
An issue in Splunk UI suppresses _span field from the view in the GUI. When 'bin span=x _time' is used in the query, add 'eval _span=' to the end of the query.

View solution in original post

0 Karma

kiran_p
Explorer

Solution:
An issue in Splunk UI suppresses _span field from the view in the GUI. When 'bin span=x _time' is used in the query, add 'eval _span=' to the end of the query.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...