Alerting

Why does the "View Results in Splunk" link in alert emails lead to an empty search results page, setting a millisecond time range on the search?

kiran_p
Explorer

Query:

index=xyz | bin span=10m _time | stats count as Count by _time

Trigger condition:

where Count > 0

My alert is triggered and I receive an alert email. When I click on “View Results in Splunk” link in the email, I land on search results page, 'Statistics' tab. I notice that the time window displayed next to the search field is correctly set to "Last 10 minutes". Time window above the tabs (Events, Statistics, Visualization) is also correctly set last 10 minutes. (Eg: 4 events (10/19/16 2:10:00.000 PM to 10/19/16 2:20:00 PM)

However, when I click on a row displayed in tabular format in Statistics tab, and I see a popup with a different timestamp, with millisecond resolution. (2:10:00.000 to 2:10:00.001)

Clicking on "View Events" link in that pop-up leads to empty results page, because of the millisecond resolution.

Did anyone run into this before? If so, how did you fix it? We are using Splunk version 6.5.0.

0 Karma
1 Solution

kiran_p
Explorer

Solution:
An issue in Splunk UI suppresses _span field from the view in the GUI. When 'bin span=x _time' is used in the query, add 'eval _span=' to the end of the query.

View solution in original post

0 Karma

kiran_p
Explorer

Solution:
An issue in Splunk UI suppresses _span field from the view in the GUI. When 'bin span=x _time' is used in the query, add 'eval _span=' to the end of the query.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...