Why does the "View Results in Splunk" link in alert emails lead to an empty search results page, setting a millisecond time range on the search?

[kiran_p]

Query:

index=xyz | bin span=10m _time | stats count as Count by _time

Trigger condition:

where Count > 0

My alert is triggered and I receive an alert email. When I click on “View Results in Splunk” link in the email, I land on search results page, 'Statistics' tab. I notice that the time window displayed next to the search field is correctly set to "Last 10 minutes". Time window above the tabs (Events, Statistics, Visualization) is also correctly set last 10 minutes. (Eg: 4 events (10/19/16 2:10:00.000 PM to 10/19/16 2:20:00 PM)

However, when I click on a row displayed in tabular format in Statistics tab, and I see a popup with a different timestamp, with millisecond resolution. (2:10:00.000 to 2:10:00.001)

Clicking on "View Events" link in that pop-up leads to empty results page, because of the millisecond resolution.

Did anyone run into this before? If so, how did you fix it? We are using Splunk version 6.5.0.

[kiran_p · Accepted solution]

Solution:
An issue in Splunk UI suppresses _span field from the view in the GUI. When 'bin span=x _time' is used in the query, add 'eval _span=' to the end of the query.